Tech questions about XL 4ET03

[canderson]

There was (once) a flash tool, but again, it was over USB. In no event did they figure on a dud bootloader that wouldn't allow for that tool to be used.
Yes, if you spot instructions for the battery change, that will get you where you need to go.

 

[Daniel 452]

I was talking about before leaving the factory. Not one bit of data is in the device on the assembly line.
Last stages are programing a bootloader and apps into the device. It is often hardware tested via the tap with boundary scan. Passing final test/inspection, it is packed and shipped.
My new router, much the same, it has a 3 wire (SPI) into the TAP. JTAG software, I can access the bootloader and 2 apps on the device. Scanning, I get the firmware hardwired into the radio. 2 NVRAM chips and the flash. Basically every bit of memory space in the router. The TAP in the CPU doesnt rely on software, it is hardwired to function with only VCC and a basic JTAG protocol. That is how I converted a Samsung satellite receiver into a radio astronomy receiver (telescope). A bootloader written by myself, and an app built with the help of a couple other engineers.
My first of month nightmare is here so will be too busy for this, but when I get back to it, I will let you know what I found. Maybe the 3rd.

 

[Daniel 452]

Just a short update. Disassembly is scary easy when you know how.
I find this is hardly more than a cordless phone but with a Samsung chipset.
The computer part around a Samsung S3 CPU and flash. 32 bit ARM, so yea, easy to hack.
The radio part I will have to add later, the Faraday shield is soldered down and has a typical ceramic pad antenna.