Might need help getting ADB/Shell on Presto A3 Restaurant Kiosk Tablet :) - Page 1
Forum section: electronics / general

author: spencerlinn
author_rank: Contributor
timestamp: November 23, 2019, 09:53:15 pm
content: So... I've acquired a most unique embedded computing device at one of my local computer surplus/salvage places, and I've been having fun trying to get access to... well, anything on it. I figured since it runs Android, and I've done some Android development in the past, I'd like to use the device for a school project instead of the Samsung Galaxy Tab we're currently using.So far, I've discovered that the device has a SATA port right below the battery with a rubber cover, very much resembling a "service" port. I suspected that it wasn't actually a SATA interface since, as far as I know, that would be quite costly to implement on an Android device that doesn't use it except in rare service instances. Pins 1, 4 and 7 should normally be ground on SATA, but I found only pin 4 was grounded on this suspicious service SATA connector. What I then did was cut up an old SATA cable and hook up each of the pins to my Saleae logic analyzer to see what I could find. The first thing I found is that on all the SATA cables I have, pins 1, 4, and 7 are all grounded internally in the cable... because merely plugging in the SATA cable caused the device to respond as the volume down button being pressed. Plugging in the cable before powering it on puts it into some kind of safe mode/bootloader mode (which makes sense as holding volume down while powering on is a common mechanic to achieve this on phones and other android devices...) but of the 4 remaining "data" pins, only one actually shows any activity, which makes me think it isn't just a USB interface being exposed on this SATA port (since USB should show differential signaling on two wires, correct?) I've spent a good while trying different analyzers in the Logic app and the only thing I've found that seems to decode anything is "1 wire", but I have no idea why this would be using a 1-wire interface for "service"... it really seems most likely that they'd use this SATA port to expose a USB client interface since this is really an android device and plugging in a SATA cable even puts it in recovery mode.Also, I have only been able to capture at 8Ms/s for some reason.. my Saleae is kinda old, USB 2.0 model, but I would have thought it would still capture at 24Ms/s as the app suggests, don't know if that's a limit on finding out what this is.If anyone has any tips on how I can approach finding out what protocol this is or perhaps recognizes it, I would be super stoked!I've attached the Logic capture data and some pictures and screenshots to show what's going on. Note: The capture shows two boot sequences. The first goes until about 5s after which the device pulls channel 3 high for the remainder of that boot, then I reboot it at about 30s and it repeats the process. In other words, only the first 5s or so is valuable.

author: spencerlinn
author_rank: Contributor
timestamp: November 25, 2019, 06:49:33 am
content: Update:I got to thinking, since I'm pretty sure this device is trying to write to a serial console, maybe it's actually serial.. like RS232 serial, as opposed to a UART. I figured given that these devices run at considerably lower voltages than PCs from the 90's (back when RS232 was standard fare lol) that, best case scenario I'd be dealing with a UART. Turns out, it actually is RS232 (or at least 5V TTL with the inverted logic of RS232...) because connecting up to a USB-Serial adapter and setting to 115200 8 n 1 (as implied by Logic's "autobaud" feature) immediately spewed out some text upon boot:Code:Format: Log Type - Time(microsec) - Message - Optional InfoLog Type: B - Since Boot(Power On Reset), D - Delta, S - StatisticS - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2.C2-00028S - IMAGE_VARIANT_STRING=DAASANAZAS - OEM_IMAGE_VERSION_STRING=bldserver3S - Boot Config, 0x000000e1B - 1566 - PBL, StartB - 4542 - bootable_media_detect_entry, StartB - 84322 - bootable_media_detect_success, StartB - 84326 - elf_loader_entry, StartB - 85563 - auth_hash_seg_entry, StartB - 109710 - auth_hash_seg_exit, StartB - 123745 - elf_segs_hash_verify_entry, StartB - 182787 - PBL, EndB - 151311 - SBL1, StartB - 196206 - boot_flash_init, StartD - 0 - boot_flash_init, DeltaB - 201361 - boot_config_data_table_init, StartD - 2379 - boot_config_data_table_init, Delta - (0 Bytes)B - 209108 - CDT version:3,Platform ID:11,Major ID:4,Minor ID:0,Subtype:4B - 214750 - pm_device_init, StartB - 217190 - pm_device_init, TEST - MSM8909 detectedB - 221338 - pm_device_init, INFO - PM8909 is selectedB - 234423 - PM_SET_VAL:SkipD - 18849 - pm_device_init, DeltaB - 235826 - sbl1_ddr_set_params, StartB - 238205 - cpr_init, StartD - 0 - cpr_init, DeltaB - 243847 - Pre_DDR_clock_init, StartD - 183 - Pre_DDR_clock_init, DeltaD - 0 - sbl1_ddr_set_params, DeltaB - 256779 - pm_driver_init, StartB - 263489 - --> Charge initB - 3752 - battery voltageB - 266966 - boot upB - 10 - Current statusD - 10675 - pm_driver_init, DeltaB - 279319 - clock_init, StartD - 152 - clock_init, DeltaB - 697565 - Image Load, StartD - 158051 - QSEE Image Loaded, Delta - (484976 Bytes)B - 855647 - Image Load, StartD - 335 - SEC Image Loaded, Delta - (2048 Bytes)B - 864065 - ## gpio99 is highB - 865254 - ##gpio99 is highB - 868274 - sbl1_efs_handle_cookies, StartD - 579 - sbl1_efs_handle_cookies, DeltaB - 876661 - Image Load, StartD - 82137 - RPM Image Loaded, Delta - (156524 Bytes)B - 958859 - Image Load, StartD - 196634 - APPSBL Image Loaded, Delta - (640940 Bytes)B - 1155492 - QSEE Execution, StartD - 366 - QSEE Execution, DeltaB - 1161226 - SBL1, EndD - 1012203 - SBL1, DeltaS - Throughput, 37000 KB/s (1284488 Bytes, 33942 us)S - DDR Frequency, 400 MHzAndroid Bootloader - UART_DM Initialized!!!SAIO A-Boot (Secure) Ver_2.5 main menu:------------------------------------------------1) View configuration data2) Enter fastboot mode (locked)3) Launch OS4) Reboot------------------------------------------------Enter selection:-->View configsaio_prd=PRESTO-A3saio_ver=C02saio_sn=PSTA3072018000432saio_mfg=saio_key=3082011802010002820100B15F743D783496B5FA74D77C975912DF580594584D329BD89F683492EA27AD66BC45CF318A384F88FD50EC85D3DBB560E989EF20B6A6B53BB9E98BD2D30EFD7984410D3A03348B3FCE64D61D37FE72D0A9374C81D4D59B6EBA3928D3BE5E3E868EDE4037BCC69E01D4DEBE4F8D01946EC5A00FB708D403B5E70DBDEAACA8EBDAF16AE46EA2A8805635AF1153176E101D03F747DD4435B963AEAC889F17168EA898AE5D549D91582ACA2E7EAC2A10F463451B80F8E9FACE5DBA37DFD63B4EEB434D3E50E974AE61367EF007459AE0B7C29606B01D3F25A1CF366DAF067D946F96856479598436B2317A61E77F68AEA0DB3468CF4B5F7863C46394DD1F55439FD90203010001020002000200020002000200402D5361496F4170507349674E3D000000000004D2D673F1215B516D1AC03CDE881FDDB7A74264E91C99B12BBDF1099148CBF69B33F465086EFAEAA24A3BC4E56B7A4B1B9156FE1090CFCDF1FC7C49966C22D30EDF3E7A45B4127127A701E025F413CDA1105B09F042301F1B38AA29890C43E3DECCB9BB1D97458B299BE177D2B539F6CEE59053FC823793027B71B355CD7ACB2534A1FF57DF8A3AFD8AF4D447F7E8A7418674A9D51CCB6DE1DF1DC30B9813E4C720A5BB6E638B1E81F910329A3F686FC28FC8184E17553B1EF39B509E0EF2DDA68735C117F61271469D07AF04E06DA0AB39A531B10768681CB8FBA8CE94A915283A7D07A649DD54DE0A4109584B22768B309CA3F68D5EC7EFCB5A71C0C5DFEB6DCA65BE75258977AA4F2EF7628593E7ABsaio_cfg=0x00000200,0x00065107,0xBB01001Esilenttamper_filterpoweroff_on_tamperpasscode=29928E9AB06EFFCASAIO A-Boot (Secure) Ver_2.5 main menu:------------------------------------------------1) View configuration data2) Enter fastboot mode (locked)3) Launch OS4) Reboot------------------------------------------------Enter selection:-->Launch OSNow, what I can do with this... doesn't seem like much. It displays some config info but won't allow fastboot (says "Fastboot is locked").Launching OS doesn't work either, although that could be due to having the volume button depressed (by the cable).

author: PlainName
author_rank: Super Contributor
timestamp: November 25, 2019, 04:01:52 pm
content: QuoteOther than in the voltage specs, how does RS232 serial differ from a UART?

author: spudboy488
author_rank: Regular Contributor
timestamp: November 26, 2019, 12:34:23 pm
content: Quote from: dunkemhigh on November 25, 2019, 04:01:52 pmRS232 is the physical layer (voltage specs, etc.) and UART is the message layer (Baud, start/stop bits, etc.)

author: PlainName
author_rank: Super Contributor
timestamp: November 26, 2019, 01:43:21 pm
content: That's what I thought but figured there might be some inference I hadn't picked up on, hence my question.Although, if we're going to be pedants, 'UART' is the acronym for the device and has sod-all to do with the message layerCome to that, whatisyour message layer? In OSI terms it would be the datalink layer, wouldn't it?