[Hardware Hacking General] E:V:A:
The Samsung Anyway Jig

Summary: Some information and pictures of the mysterious Samsung Anyway Jig

Skill Level: Medium

==================================================

Do NOT post questions/requests on how to obtain one, they

will not be answered. (Because I have no idea, since its

Samsung proprietary test equipment!)

Do NOT post links to commercial jigs, unless you also post

the internal schematics, in such a way that it can be easily

constructed at home.

If you already have a working home-made multifunction jig

that you would like to share, please remember:

- a picture of the device

- a picture of the schematics

- a detailed parts list

- the phone/models it applies to

- any other relevant features to make it work

==================================================

Purpose

As custom ROM flashing become more and more popular, the XDA-forums are

continuously bombarded with questions and answers on how to debrick their

devices, often using (what used to be) professional hardware analysis and

debugging equipment, like vendor provided JTAG, JIG and software flashing

tools. These tools used to be only available to certified technical repair and

support centers, closely connected with the various phone vendors. However,

this scenario is rapidly changing as more people are getting higher technical

skills, while using these devices and tools on their phones.

One particular such device, provided by Samsung, has been used for years to

program, customize, repair, debug and unbrick essentially all available

Samsung phones. This blue box is called the "Samsung Anyway Jig", and somehow

Samsung has managed to hide it from public scrutiny and analysis, which have

elevated this device to an almost mythical status. At least for the common

person wishing to repair or modify his phone. Probably because Samsung have

realized that there is a great profit to be made, by having their customer

sending their phones in for repair, rather than letting them in on the simple

secret on how to do this kind of repairs themselves. This behavior have also

been a great joy for the few professional service centers that actually have

access to this device (or similar devices) or who were able to figure out how

it works, making it into a million dollar industry, and obviously without

sharing their knowledge to the public.

Thanks to great community oriented websites and forums like XDA and others,

the public awareness have increased to such a level, that today anyone (with

minimal soldering skills) can build a multifunction and debricking JIG. And

because of the increasingly better standardization among mobile phone

manufacturers, very few modifications are needed for this device to be working

with essentially any modern mobile-phone on the market.

This thread is an attempt to better understand the Samsung Anyway Jig, such

that one can build his/her own Jig, with the information contained herein,

together with many other publicly available documents. It shall be noted that

I do not have access to this device, and I have neither factual data, nor

info, on how this thing actually works. But I do have a very good idea!

Close inspection, of the only 3 (!) images found, as obtained by Google Image

Search (which I am growing increasingly unhappy with), provide a good start

for what is going on in that device.

The Anyway Versions

The Anyway Jig come in slightly different versions. And since I only have access

to 4 pictures, I cannot tell what other versions are available. However, I

noticed the following:

[SIZE=2]Version PartNumber Variation/Note
-------------------------------------------------------------------------------
S100 Doesn't have "EMP" Solution
S101 GH99-36900A Has "EMP" solution. Is used with GT-S7230 (Bada OS)
S102[/SIZE][SIZE=2] GH99-36900B [/SIZE][SIZE=2]1.2A High-Current version for Tabs & Tablets
[/SIZE]

So let me first reproduce the text as seen on the photo of this box:

[SIZE=2]
| Function
-------------------------------------------------------------------------------
No Solution | Mode OFF ON
-------------------------------------------------------------------------------
1 Agere TC | Boot Low High
2 Hp, Vision, Infineon | SDS O X
3 NXP Sysol | USB O X
4 NXP Swift Broadcom | DBG X O
5 UMTS (Qualcomm) | M-USB Use Not Use
6 EMP | ID type UART USB
7 - | ID-BOOT Boot-On Boot-Off
8 - | - - -
9 - | SDS TRX - Loop
10 - | DBG TRX - Loop
-------------------------------------------------------------------------------
| O = Connect, X = Disconnect
[/SIZE]

"The Solution"

The first thing to notice, is that the "Solution" column is completely

independent of the "Function" column. The "Solution" column seem to refer to

the manufacturer of the modem hardware used in the device, usually the

cellular/baseband processor (CP/BP) used by your phone or the modem chip in

routers etc. You can find out what you have by using the methods I have

outlined in the thread: "Phone/Modem Hardware Cross Reference List".

Once you know what you have, you use the 10-pole (BCD?) rotary micro-switch,

as shown in the picture below, to set it to the number corresponding to your

phone modem. (The settings in that picture, corresponds to a Samsung Wave

[GT-S7230] which has a Broadcom BP and thus the rotary-switch is set to #4.)

But according to this document, for attaching a [GT-I9000], you need to set

it to #2 (for Infineon).

It is unclear at this point whether or not this setting is actually changed

much when using various modern phones. It is more likely that this is used for

backward compatibility to older phones that use older connectors, and that new

phones all use the same setting since most of them, now use micro-USB

connectors. Otherwise it simply wouldn't make sense to use a

micro-rotary-switch, especially considering the vast number of modems chips

available today, while the uUSB standard connectors doesn't allow other

signals.

"The Function"

As you have already noticed, next to the rotary switch, there is a 10-pole DIL

switch, that is used to set the Jigs "Function", or behavior. The table above

show the various functional options available, that you can use for the JIG.

Although it is unclear what all these functions actually does, without access

to a box or manual, we are free to make some educated guesses.

Here we make the following (rather wild) guesses as what the various modes does:

[SIZE=2]DILpos Mode Typical What Description-Guess
-------------------------------------------------------------------------------
1 Boot 0 Low ??
2 SDS 1 X ??
3 USB 0 O ?Enable/disable USB pass trough: [target]--->[JIG]--->[PC]
4 DBG 0 X ?Enable/disable debug by "port":
5 M-USB 0 Use ?Enable/disable modem USB connection
6 ID type 1 USB ?"Interface Dongle" output-side selection (wheter to use the USB or UART to connect to PC)
7 ID-BOOT 0 Boot-on ?Determines if the device should bootup/start when connected to the JIG.
8 - - - -
9 SDS TRX 0 - ?Enable/disable Loopback on this interface
10 DBG TRX 0 - ?Enable/disable Loopback on this interface
-------------------------------------------------------------------------------
where (0==OFF, 1=ON) of the 10-pol DIL switch,
while "O" is connect and "X" disconnect.[/SIZE]

If you have any knowledge of what these does, please let us know. For example,

I like to know what the "SDS" refers to and what it is/was used for?

Then What?

So how interesting is this, for our modern Android based and micro-USB

connected phones, on a scale from 1-10? Probably not much more than 3.

Because most of the device magic happens inside the phone, determined by

various internal multiplexers (MUX), resistance/capacitance detectors, the

Power Management IC (PMIC) and related device drivers.

The most important thing to understand, is that today there are very specific

standards regarding what functionality is offered and expected, given certain

conditions on the micro-USB signals. For example, shorting the D+ and D- USB

signals, tells your phone to start charging, using the VBUS and GND lines.

While a resitive short between the micro-USB lines ID_CON (pin 4) and GND

(pin-5), allows and selects a wide range of functionality from remote control,

debug mode, download mode, audio/video transfer and everything else you may

want to do. These are some of the things we would like to focus on here.

So what is more interesting, is how we can build a JIG that is much more

modern and useful than this old dinosaur, that can provide us with a fully

controlled set of the functions mentioned above. So if you still dream about

getting one, forget it and build your own! Below I will link to a list of DIY

multifunction JIGs. That means I only list serious JIGs that contain a little

more functionality, than just a resistor. Post if you have something worth

showing.

Useful Resources

*Fun with resistors (home/car dock mode + more)

Lets Save Some Bricks

*The Captivate Development Platform mod AKA UnBrickable Mod

Set up a Captivate for Samsung Bootloader Development

The Vibrant Development Platform AKA UnBrickable Mod

USB Jig FAQ (Frequently Asked Questions) [4/4/2012] ICS bootloader added

Galaxy S UART JIG & Debugging Connector

Complete USB2.0 Specifications (>13 MB, 30 files, main: 650 pages)

USB Battery Charging Specifications 1.2 (71 pages)

FSA9280A Datasheet (Used in SGS1)

FSA9285 censored Datasheet ()

FSA9485 censored Datasheet ()

FSA3200 Datasheet (Used in SGS2)

---------------------------------------

* Strongly recommended reading

Let me know of any dead links.

Here is an internal photo of the original Anyway S100.

Keywords: jig, samsung, anyway, resistors, multiplex

​

UPDATE: 2012-10-24

Anyway Software, Drivers and Manuals for:

Anyway D100 (8 port factory jig)

Anyway S100 (1 port factory jig)

Can be found for download in Post#67 ...

​