[Hardware Hacking General] E:V:A:
Guessing the Baseband Processor

Guessing the Baseband Processor

In the darkness of cellular/baseband processor manufacturers lack of

information on their products, the rest of the world have to resort to various

methods, usually only reserved to avid hackers, just to get minimal

information on what is acting behind the dark curtains of your phones radio

processor.

These methods involve everything from common Google-Fu, FCC image inspection,

deep hardware tear-apart guides to firmware investigation.

Therefore in order to make this more simple for common users, I have designed

the following baseband processor (BP) table, listing some detailed features of

the more common and modern smartphone BP's. Thus when you are reading the

awesome specs about a particular phone, you should be able to use that info to

guess what BP is used within that device.

Useful Resources:

Google - Search for terms like "baseband, cellular, processor, radio, modem"
FCC ID - Search for manufacturer specific device id's, then go to "details"
and look carefully on the internal photos.

The Inside Picture

While some companies are making large money on tearing apart and analyzing new

electronic devices and components, to the sub-microscopic level, there are

several less costly alternatives you can use to find out "what's inside".

These are often referred to as "tear-apart", "teardown" guides, or "may just

be a simple picture gallery of the internal parts.

The places to help you out, is as always Google Image Search, but it can a

slow process. Better are to search common websites already known for their

free quality teardowns and high-resolution images, that you will surely need.

Here is a few.

AnandTech

AndroidCentral

iFixit

TechInsights

Ripping it Apart

If you can't find any "tear-apart" guides or useful photos anywhere, you may

consider opening up your device and find out by your self. If you do so, keep

in mind that you will surely void any warranty while risking to brick your

device by breaking something microscopic inside. Don't forget to take many

Hi-Res photos of your operation so that you can share it with the rest of us!

When doing this it is also of essence to have the right tools. A good tool-box

reference is to use similar tools as those used by the iFixit tear-down

engineers. Here are a few good toolkits, for reference.

Trolling the FCC

The Federal Communications Commission (FCC) website is a great place to start

finding some juicy information. All phones that will enter the European or

United States markets, are required to have an FCC license/approval. Thus all

radio devices available there should also be available at FCC. Therefore phone

manufacturers wait until the very last moments, before release, to apply for

these licenses. Although all mobile manufacturers apply for FCC non-disclosure

agreements, there are usually juicy internal pictures, radio specifications,

measurements and component labeling placement data. The trick is to find the

FCC ID of the device you are interested in. This is not always very easy for

new unknown devices, but you may guess by knowing your the manufacturers

"Grantee Code". But there are many other search possibilities as well.

The FCC ID Search Form requires:

"[COLOR=Red][I]Grantee Code[/I][/COLOR]" - First three characters of the FCC ID
"[COLOR=Green][I]Product Code[/I][/COLOR]" - Remaining characters of the FCC ID
[COLOR=Red][COLOR=Black]---
Example: [/COLOR]A3L[/COLOR][COLOR=Green]GTI9100[/COLOR]

Here is a table of some common Grantee Codes:

[SIZE=2]---------------------------------------
Company Code
---------------------------------------
AMOD TLT
Apple
Dell
HP
HTC NM8
Huawei QIS
Lenovo PD9
LG BEJ
Motorola
Nokia BCG,LJP,PPI,QTL
Samsung A3L
Sony-Ericsson PY7
Toshiba
ZTE
[/SIZE]

Note-1: A company may have more than one Grantee Code.

Note-2: A company may "outsource" their FCCID to their internal device's OEMs.

Trolling the Patent Bureaus

It is almost surprising how many hardware secrets can be revealed during the

many IP and Patent litigation's, during which a lot of material must be

presented in open court documents. Not to mention all the new devices they

try to patent by huge broad spectrum "patent-jacking" efforts. (Apple, Samsung

and Broadcom are always fun!)

Google Advanced Patent Search

European Patent Office

Free Patents Online (FPO)

United States Patent and Trademark Office

Directory of Intellectual Property Offices

Scraping OEM Websites

Look at the baseband OEM 's websites for hints on what phones and operating

systems they brag about having delivered to. In addition, most embedded

baseband related devices are running on an ARM platform. So you may also look

at the ARM website, to find what partners they have. Also see:

Cellular Baseband Market Share Tracker

The most common BP manufacturer's

:

Broadcom

*Freescale

Icera (NVidia)

Intel/Infineon

MediaTek

Marvell

Qualcomm

Renesas Mobile

ST-Ericcson

*Skyworks

Spreadtrum

Texas Instruments

VIA Telecom

______________________________

* Makes mostly RF related sub components.

Guessing the Baseband Product Table

In order to make an educated and good guess you need to pay close attention to

the following features/variables:

Manufacterer Brand Names eg: SMARTi
Manufacterer Sales Points eg: First all in one PoP technology
Protocol Speeds eg: "HSDPA/HSUPA at 21Mbps/5.7Mbps"
Protocol Classe(s) eg: "EDGE multislot class 33"
Supported Communication Protocols: eg: GSM, GPRS, EDGE, HDSPA etc.
Trancesiver Technology eg:

and many more. You get the point!

Here is, for example, a product list from Intel:

[SIZE=2]-------------------------------------------------------------------------------
Product Protocol Description Features
-------------------------------------------------------------------------------
1010 GSM/GPRS

[/SIZE] [SIZE=2] Based on X-GOLD 101, with the XMM1010 platform Intel pioneered the
Ultra-Low Cost market with a revolutionary 2G baseband and platform
solution.

[/SIZE] [SIZE=2] • Industry first phone on a chip: baseband, RF engine, power management and memory
• Enable low BOM for black and white handsets
• Best in class GSM/GPRS modem

1100 GSM/GPRS [/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 101, the XMM1010 platform is a ULC feature evolution,
65nm "phone on a chip" integrating additional functionality such as FM
Radio, MP3 and sufficient memory to support a colour display phone
without external SRAM.

[/SIZE] [SIZE=2] • GSM, Dual SIM
• Lowest BOM by integrated FM Radio, SRAM, serial Flash and low cost PCB
• Lowest power consumption – less than 1mA idle current, best in class talk current

1180 GSM/GPRS[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 118, the XMM1180 platform is a GPRS System on a Chip
in 65nm, the high integration and possibility to use low cost PCB
makes it possible to ideal solution for lowest cost messaging and
multimedia phones.

[/SIZE] [SIZE=2] • GPRS with great multimedia performance & user experience
• Dedicated 1.3Mp Camera support, integrated FM-Radio, MP3 and USB
• Lowest power consumption – best in class talk current

2130/50 EDGE[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 213/215, the XMM2150/2150 platform is an EDGE System
on a Chip in 65nm with multimedia performance typical for higher
segments. The high integration level and possibility to use low cost
PCB makes it possible to develop lowest cost EDGE browsing and
multimedia phones.

[/SIZE] [SIZE=2] • EDGE downlink at cost of GPRS, enabling low-cost mobile browsing
• Powerful CPU for great multimedia performance
• Common software architecture for scalability from 2G to 3G
• Integrated FM-Radio
• Lowest power consumption – best in class talk current

2231 EDGE[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Form Factor Reference Design based on XGOLD223 EDGE 65nm SOCs.
3.2-inch capacitive touchscreen, 3Mpixel camera, connectivity (WIFI,
A-GPS, BT, FM Radio), Motion sensor, Electronic compass, Proximity &
ambient light sensor and slim metal-like case.

[/SIZE] [SIZE=2] • Android 2.2, updated planned to 2.3
• Scalability to 3.5-inch HVGA
• Quad band EDGE

6130 HSDPA[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 213 and SMARTI UE RF transceiver, the Intel XMM 6130
Phone Platform is a cost-optimized 3G feature phone solution enabling
affordable mobile broadband devices for Emerging Markets.

[/SIZE] [SIZE=2] • Cost-effective platform for rich multi-media and browsing experience
• Common CPU architecture enables scalability from 2G to 3G
• Worldwide proven HSDPA Rel.6 modem stack

6160 HSPA[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 616 Digital- and Analog Baseband with integrated Power
Management Unit and the 2G/3G Transceiver SMARTi UE, the XMM 6160
platform is an easy upgrade from the XMM 6080 as both are based on the
Intel Comneon Protocol Stack.

[/SIZE] [SIZE=2] • HSDPA/HSUPA capabilities of 7.2Mbps/5.7Mbps with EDGE multislot class 12
• Hardware and software interface to an application processor or a PC as wireless modem
• LP-DDR1 and NAND memory support

6260 HSPA+[/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 626 Digital- and Analog Baseband with integrated Power
Management Unit and the 2G/3G Transceiver SMARTi UE2, the XMM 6260
platform is the smallest available HSPA+ modem supporting a global
connectivity within one stock keeping unit.

[/SIZE] [SIZE=2] • HSDPA/HSUPA capabilities of 21Mbps/5.7Mbps with EDGE multislot class 33
• Penta-band 3G, Quad-band EDGE with Receive Diversity type 3i
• Supports worldwide connectivity in one design
• Extremely small PCB footprint and power consumption
• Hardware and software interfaces to applications processors or to a PC as a wireless modem

6360 DC-HSPA [/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 636 Digital- and Analog Baseband with integrated Power
Management Unit and the 2G/3G Transceiver SMARTi UE3, the XMM 6360
multimode platform is the smallest available DC-HSPA modem supporting
a global connectivity within one stock keeping unit. HSDPA/HSUPA
capabilities of 42Mbps/11.5Mbps with EDGE multislot class 33

[/SIZE] [SIZE=2] • Multi-band Penta-band 3G, Quad-band EDGE for worldwide connectivity
• Supports worldwide connectivity in one design
• Excellent power consumption and extremely small PCB footprint
• Hardware and software interfaces to applications processors or to a PC as a wireless modem

7160 Multimode LTE & DC-HSPA [/SIZE] [SIZE=2]

[/SIZE] [SIZE=2] Based on X-GOLD 716 Digital- and Analog Baseband with integrated Power
Management Unit and the 2G/3G/LTE Transceiver SMARTi 4G, the XMM 7160
multimode platform is the most compact solution for LTE/DC-HSPA Smart
Phones for worldwide deployment.

[/SIZE] [SIZE=2] • LTE capabilities of 100Mbps/50Mbps
• HSDPA/HSUPA capabilities of 42Mbps/11.5Mbps with EDGE multislot class 33
• Multi-band LTE, Penta-band 3G, Quad-band EDGE for worldwide connectivity
• Excellent power consumption and extremely small PCB footprint
• Hardware and software interfaces to applications processors or to a PC as a wireless modem
-------------------------------------------------------------------------------
[/SIZE]

Enjoy!