Table of Contents


hardware on the PCB:

  1. XILINX Spartan-3 XC3S1200E : FPGA is only used for the modulation (The later version of the picochip include this, there is no FPGA needed anymore)
  2. picoChip PC202 : main processor, UMTS processor
  3. Spansion S99-5??06 : 64MB Flash. The free memory socket is the “alternative”. If no intel memory exist, AMD memory is put on it. K2 dumped the memory using that
  4. SIM card slot
  5. power input : 6V, 2A max
  6. Ethernet RJ45 connector
  7. NXP TDA8029HL07 : card reader
  8. MAXIM MAX2599 : WCDMA/HSPA transmitter
  9. MAXIM MAX2547 : WCDMA/HSPA receiver (also for GSM sniffer)
  10. antenna (2G?) (additional murata connector)
  11. antenna (3G?) (additional murata connector)


  • the hardware flag is defined in customisation.ini as hwflag.
  • it defines the running mode (see rootfs/etc/init.d/rcS l.66)
  • it controls the login prompt rootfs/etc/inittab.hwflagn

here are the modes

  1. Development: login prompt activated, u-boot interruptible, failed signature verification ignored
  2. Trials: login prompt activated
  3. Commercial: login prompt not activated

the root password is in md5. md5 is not secure anymore, thus it's possible to get the plain text password : advent

there is a serial port ttyS0 on the board. the pins are the following :

  • GND : TP417
  • Rx : TP415
  • Tx : TP416
  • conf : 115200 8N1

radio license

SFR is in possession of HNB licenses. These are applied as soon a you connect to their network. This is the reason why you are not allowed to:

  • use it outside France: the license are issued for France
  • use it as your own access point: a license is needed to transmit on the UMTS frequencies.

more info :



The SIM card is used to establish the IPsec tunnel. It's driven by a continuous 3.6864MHz clock (leading to a 9910bps serial communication). It does not put the SIM in sleep, but powers it on when required and off immediately afterwards, thus resetting it all the time.

A tool to sniff the traffic is this device (old). It uses a FT232RL, but this gets off track on long communications (not precise clock). The bus pirate handles better the serial communication (9600 8N1).

The other, better solution is SIMtrace or use the debug trace possibilities.

hardware.txt · Last modified: 2011/08/30 17:34 (external edit)
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 3.0 Unported
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki