[Hardware Hacking General] E:V:A:
Intel / Infineon XMM6260 & X-GOLD 626 Modem Hack-Pack Release!

After several unsuccessful months of trying to get my phone (application) to

talk AT-commands with the baseband processor (BP), I've had to learn a lot of

hardware and internal Android and OEM based tricks and secrets. Although this

have not been enough to make anything of practical use, it is definitely worth

sharing. If not at least some more talented people may be able to continue

where I have left of...

Now, it should be immediately stated that there is nothing revolutionary

in here, apart the Infineon manual for tuning your GSM modem, using the

AT CLI and GTI sequencer. This is something that could potentially be very

useful for better understanding the advanced features that the modem

platform incorporates. However, it is also a sure way of making a an

expensive brick out of your phone! You have been warned...

Brief Modem Description

The XMM6260 is the "platform" that consists of:

The X-GOLD 626 baseband processor

The SMARTi UE2 RF-transceiver DSP

The 3GPP Release 7 HSPA+ protocol stack with:

Downlink: Category 14, Uplink: Category 7

The X-GOLD 626 baseband processor (labelled "PMB 9811") is communicating

with the DSP RF-tranceiver chip called SMARTi-UE2 (labelled "PBM 5712 A1"),

using a communication interface that corresponds to the MIPI DigRF-3G

(V.3.09) standard. Through this protocol the BP can control some or all

aspects of the RF DSP.

Alternative Names

Infineon IFX6260

Intel IMC6260

Intel XMM626

Some other devices using this platform:

- Lava XOLO X900 [Phone] FCC ID: ???
- Lenovo K800 [Tablet/Pad] FCC ID: ???
- LG-P920 (LG ?) [Phone] FCC ID: BEJP920
- LG-P925 (LG Optimus 3D?) [Phone] FCC ID: BEJP925

- Huawei E369 (3G Hi-Universe) [USB 3G Modem] FCC ID: QISE369 (Russian distrubutor: Merlion)
- Huawei MU733/MU739 [PC/CE Module] FCC ID: QISMU739
- Samsung Galaxy Nexus (I9200) [Phone] FCC ID: ???

Other devices that may (!?) also contain the X-GOLD 626:
---------------------------------------------------------
- LG Optimus 4X HD [Phone] FCC ID: ???
- HTC One X [Phone] FCC ID: ???
- Huawei Ascend D Quad [Phone] FCC ID: QIS ???
- Huawei E392 (E392u-511) [LTE Multi-mode USB stick] FCC ID: QISE392U-511
- Huawei E353 (E352s-6) [HSPA+ USB stick] FCC ID: QIS ???

Hack-Pack Content

- Pictures/Diagrams:
- XMM6260 colored pinout map
- XMM6260 mounted in a Samsung Galaxy S2
- SMARTi UE DSP RF-tranceiver chip mounted in the SGS-2
- IPC xxxxxx stuff
- Infineon PhoneTools testing program
- Raw 1byte greyscale PNG of modem.bin from XXKI1

- PDF files/documents:
- ITA-RF-Adjustment-GSM (XMM6260 Specification)
- Infineon MIPI-HSI Product Brief
- X-GOLD 616 Product Brief
- Fairchild FSA9280/88A USB/UART switch/MUX datasheet

- Similar Modem AT sets/documents:
- AT_Command_Set_3GPP-TS-27007-940.pdf
- AT_Command_Set_AMOD_HSPA.pdf
- AT_Command_Set_Gobi.pdf
- AT_Command_Set_Motorola_XM7200S.pdf
- AT_Command_Set_Teltonika_TM3.pdf
- AT_Command_Set_iWOW_TR-900.pdf

- Text Files:
- 3GPP 27.007 AT-list
- XMM6260 official AT-set
- XMM6260 internal AT-set
- XMM6260 homebrew specifications
+ X-GOLD 626 Modem pinouts
+ MUX pinouts
+ AP connections (SGS2)
+ AP relevant info
- Strings of modem.bin (stock firmware image: [B]XXKI1[/B])
- Strings of drexe
- Strings of rild
- Strings of libril.so
- Strings of libsec-ril.so

- GT-I9100 stock (GB 2.3.4) binary files:
(Taken from: PDA:[B]XWKI4[/B], Phone:[B]XXKI1[/B])
- libKiesDataRouter.so
- libril.so
- libsec-ril.so
- libsecril-client.so
- drexe
- rild

- Android hardware hacking binaries (tools):
- dbus-monitor
- dbus-send
- hciconfig
- hcidump
- hcitool
- i2cdetect
- i2cdump
- i2cget
- i2cset
- ipcfilter
- ipcdump
- ipctool
- procmem
- showmap
- showslab
- strace
- tcpdump
- viewmem

+ various other content

Download Here! (57.72 MB)

The modem firmware referred to and studied can be

found here (Modem.bin.7z) or here, under "XXKI1".
​

-------------------------------------------------------------------------------

DISCLAIMER:

All the material in this collection was found on internet by

appropriate Google-Fu and/or by laborious manual creation.

Nothing is stolen or reversed, so I am not held responsible

for the origin or problems affiliated with the use of these

documents, programs or other binaries.

-------------------------------------------------------------------------------

​

If you are a developer or other corporate official of Intel or Infineon:

Please contact your superiors and ask them to release the proper

datasheets and documentation of these products to the public.

Why? Because:

It would significantly increase the sales of your hardware, by promoting

a much more open approach to hardware development. There are currently

more than 10 open-sourced and open-hardware smartphone projects around

the world, who would benefit from the use of a more modern baseband than

what is currently and openly available.

.

It would significantly promote your hardware in front of your competitors,

as your company would be the first one to open up your documentation to the

public. Thus increasing public technical knowledge of your hardware, which

would ultimately lead to you having an easier time to find qualified

developers that cost you less!

.

It would significantly reduce the cost and time for firmware development,

while increasing the firmware code-quality and compatibility, as you

would be able to benefit from the large community and knowledge from

other professional developers as well as hardware-hackers.

(Yes, there are several bugs found in your firmware, but since there is

no way to report and discuss these with your developers, they will

continue to cost you money and head-scratching for all developers

having to deal with your platform.)

.

Your competitive advantage due to 1-3, would promote new and better

future hardware developments, that would not only benefit your

company/business but also society as a whole.

.

Its simply the right thing to do!

The thread where all this become crisply relevant is this one:

[A][SGS2][Serial] How to talk to the Modem with AT commands

There you will find all documents which I have found to date, which

is essentially none. At least nothing that can be of ANY practical use.