OSHW Apple Lightning Connector? - Page 1
Forum section: electronics / general

author: amyk
author_rank: Super Contributor
timestamp: November 06, 2013, 11:55:37 am
content: It seems like although the Chinese have RE'd the protocol, no one has yet published any detailed information.Here's some info that points to it being possible without any custom ICs:http://appleinsider.com/articles/12/10/31/functional-chinese-knock-off-of-apples-lightning-cable-disassembledThat's a C8051F300 (8051 shows up again!) and some other SMDs I can't identify.http://www.chipworks.com/en/technical-competitive-analysis/resources/blog/systems-analysis-of-the-apple-lightning-to-usb-cable/Something similar:http://www.righto.com/2013/06/teardown-and-exploration-of-magsafe.htmlIt's a 1-wire protocol, wouldn't be hard to figure out. Possible OSHW project idea?

author: amyk
author_rank: Super Contributor
timestamp: November 07, 2013, 01:13:16 pm
content: The official cable contains an EEPROM but the Chinese look to be emulating it with an 8051 - if they're not emulating all the aspects of that EEPROM, then they can find a difference, however if it behaves just like the real thing then Apple can't do anything (unless they break alltheircables too).I personally use Android (on Apple-shaped hardware), just curious if there were any interested iDevice hackers here...

author: cloudscapes
author_rank: Regular Contributor
timestamp: November 07, 2013, 04:04:00 pm
content: though in general I prefer Android, it isn't all rosy either.my htc one has started forcing system update notifications down my throat. I want to hold back because I hear the update makes it drain battery life a bit more, and that the new features are of absolutelly no benifit to me. the notifications are pretty annoying, every 4 hours, full-screen with multiple clicks to get out of them (remind me later, in how much time, etc). it doesn't offer a way to turn it off, so I just unlocked my phone (big hassle costing me a couple hours of work, because the backup tool half-assed its job). I had read there was something you could do to stop update notifications after unlocking this phone, renaming a file in the system directory. it didn't actually work, though, and they started showing up all the time again./rantjust to say that Android is far from"truly" open. it's only "relatively"

author: kripton2035
author_rank: Super Contributor
timestamp: November 07, 2013, 05:37:17 pm
content: apple can update the software inside the lightning cable if they want. throught an itunes update for example...so even if some chinese people reverse the thing, an update and hop ...and sorry but for me android is fully open ... to malwares !

author: cloudscapes
author_rank: Regular Contributor
timestamp: November 07, 2013, 07:45:26 pm
content: Quote from: kripton2035 on November 07, 2013, 05:37:17 pmOnly if you tell it to accept "unauthorized" apps in the developer settings.

author: cloudscapes
author_rank: Regular Contributor
timestamp: November 08, 2013, 10:48:19 pm
content: Quote from: mojo-chan on November 08, 2013, 11:34:51 amMaybe. Still, it's absurd that I have to jump through so many hoops just so that I can avoid installing something I don't need and that actually slightly hinders it (allegedly).

author: amyk
author_rank: Super Contributor
timestamp: November 09, 2013, 02:41:58 am
content: Quote from: kripton2035 on November 07, 2013, 05:37:17 pmAFAIK there's no actual software in the official cable, just an EEPROM...

author: kripton2035
author_rank: Super Contributor
timestamp: November 09, 2013, 08:10:26 am
content: there are 4 chips inside the connector, and two "big" ones from TI and NXP simply nobody knows what they do...

author: amyk
author_rank: Super Contributor
timestamp: August 29, 2014, 11:30:30 am
content: Putting some more info in this thread sincean Apple-only productmay be wanted by others...* BQ2025 has "2501" on the die and Maxim make a DS2501, both are 1-wire EEPROMs* BQ2024/BQ2026 are also OTP EEPROMs with very similar interface, basically 1-wire compatible.Comparison of datasheets.* NXP NX20P3 is a load switch, as evidenced byimage found on Chinese siteand NXP havingNX3P/5P/18Pseries load switches. It wouldn't be much of a stretch to hypothesise that the NX20P3 is a 20V, 3A version.keywords for future potential visitors: Apple lightning cable reverse engineering BQ2025 DS2501 EEPROM 1wire NX20P3 NX18P

author: kwallen
author_rank: Contributor
timestamp: August 31, 2014, 11:10:55 am
content: Quote from: mojo-chan on November 06, 2013, 03:35:41 pmMore incredible is their Lightning AV adapter, whichseems to include a rather beefy ARM SoCinside it just to handle the 720p video coming over the wire. Every time you plug the device in it checks a remote server, and pushes whatever the latest binary is into the RAM of the device in order for it to boot.About the start of August they started pushing new protections for Lightning cables as well which broke almost all knockoff cables with clone authentication chips in them. I believe the update URL is used for normal cables as well as the media device, as I had some un-updated devices start rejecting clone cables I had lying around and only accepting legitimate ones. Just from using clone and legitimate cables, their protections are at least somewhat timing based. Often clones are able to work a portion of the time, sometimes failing out as illegitimate and other times authenticating properly.

author: amyk
author_rank: Super Contributor
timestamp: September 02, 2014, 05:38:09 am
content: Yes some of their adapters require firmware but that's true of certain USB devices too - the first example that come to mind are all the logic analysers (Saleae and clones) and various other adapters based on the Cypress FX2/LP.QuoteThis lends more evidence to the theory that the MCU they're using to emulate a 1-wire EEPROM might not be fast enough - it was fast enough to handle the timings that Apple originally used but they've reduced the margins in future updates. As I mentioned above, incomplete emulation of the protocol would be another cause; the Chinese attitude of "if it works, ship it" probably made them just record the data with a logic analyser, program an MCU to spit out same, and started selling the cables.AnotherhintI found:QuotePlugging in the USB end first powers up the MCU so it can talk to the phone, whereas doing the opposite doesn't. A real 1-wire EEPROM doesn't require a separate power source. With a suitably low-power MCU, it should be possible to do that too.

author: kwallen
author_rank: Contributor
timestamp: September 24, 2014, 03:05:40 am
content: Quote from: amyk on September 02, 2014, 05:38:09 amJust by luck I came across one of these cables that was blacklisted and took it apart just to see what is going on. Inside there's only two devices on a tiny tiny PCB, no passives at all.A1SHB -P-Channel MOSFETSDL01 - must be some sort of microcontroller, but I can't find a data sheet or any other information

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 01, 2014, 03:05:30 pm
content: There's apparently a jailbreak tweak to ignore the check. I personally just use Android, but some engineers like the challenge of hacking something that is purposely made difficult to hack...

author: fake-name
author_rank: Regular Contributor
timestamp: October 13, 2014, 09:14:58 am
content: Quote from: mojo-chan on September 30, 2014, 03:41:57 pmThat is not true.If you do a full reverse-engineer (e.g. decap the chips and fully understand their contents), it is possible to completely emulate them.It's only black-box reverse-engineering that has issues, because you don't have access to the internal state of the device, so you're stuck making inferences.

author: microbug
author_rank: Frequent Contributor
timestamp: November 02, 2014, 12:10:23 am
content: It could work without full emulation if it were less portable/practical: a larger board with an ICSP header so that you could reprogram the MCU software when Apple updates theirs.

author: ratdude747
author_rank: Regular Contributor
timestamp: January 15, 2015, 03:06:49 am
content: And THIS is why even 3rd party cables are so bleeping expensive (having a finacee whose lost a couple of them, this crap gets old fast).Never buying an iphone, ever, thanks to this. DRM in a cable??? Even just to charge? What has this world come to???And I thought my ATT S4 was a POS since it has a bleeping locked bootloader (and safestrap is a joke, please).What's next, RFID enabled cell phone stands? C'mon sheeple, buy the new iStand and iHolster, with a built in iWallet that is almost useless since you burnt all your cash on our iTrash!

author: Am0rph
author_rank: Newbie
timestamp: June 06, 2018, 08:41:58 am
content: Quote from: kwallen on September 24, 2014, 03:05:40 amHi,Came across this post on Google when I was searching for a similar issue. I cracked open a Chinese Apple cable and just wanted to see what they are using on the connector. Found out a 3415 (BJT NPN 25V 500mA), 2 resistors 150 ohms each and a Ceramic Cap 2.2 uF. There is a chip (6 pins). So I had two cables and both have different chips - one has AD07 labeled on it and the other has 'SLH012 1736' labeled on it.Could you find out what they actually were?Thanks!