[Hardware Hacking General] E:V:A:
Opening the E589

The E589 tear apart or tear down!

So, since I could not find any information anywhere, on how to tear this baby

open, I had to do essentially that. I though the the FCC internal and external

photos would have helped me out, but with my inexperience, I did not recognize

the signs of the attachment mechanics. This made me break two plastic pryer

tools and almost the back cover itself, until I found that magic screw!

The screw is hidden under the SD card slot and under a cover of white paint,

which is why I missed it, since I thought it was the SD card eject button!

This is a normal Phillips head screw (PH00), and once you get it out, you

should be able to slide the cover off easily. Here's a picture showing the SD

card slot with the screw and the direction of the cover slide-off movement.

This movement is downwards from the back side/label point of view.

Then the battery seem attached somehow, first with a plastic flap and then most

likely with some glue/sticky tape... It seem very hard to detach, so I gave

up at this point, in fear of braking something that I need and that is not

already broken. (I don't wanna ruin the battery.) Here's a picture of that.

Now you should be able to remove the whole battery and then the battery connector.

The battery is glued to the back plate which also works as a heat sink for the underlying

components, so you have to be very careful not to pull too hard on the battery or you

risk also pulling some components from the PCB. Use some kind of tool to carefully pry the

battery lose, one side at the time.

Secrets under the battery

Thanks to chup in THIS post at MobilaBredband, we find some more secrets

behind the battery.

The first thing that sticks out, is the 5-pad slot. If it's a serial connection,

we only need 3 pads; Rx/Tx/GND. Indeed the square pad is connected

to GND. So what are the other options?

It could be either one of:

1) a set of minimal JTAG terminals according to SW-DP specifications for IEEE P1149.7.

2) a way to shorten something out, like an MDM9200 XO BOOT device option pin.

3) a second set of UART serial connection. We know MDM9200's have more than one...

4) a battery replacement port during assembly, service or factory testing.

Here we can also see the various internal antennas. There are three (3)

strip-line antennas integrated into the plastic parts on the top and the

bottom of the router PCB. Two in the top parts and one in the bottom. On the

top-left of the front/screen side of the PCB, is the connector to what Huawei

call the "Wifi Antenna". Then on the top-left, of the backside of the PCB, we

find what Huawei call the "Diversity Antenna" connectors, while on the

bottom-right, we find the "Main Antenna" connectors. Basically:

TOP-F "WiFi Antenna" Wifi (~2400 GHz)
TOP-B "Diversity Antenna" <GPS/unknown>
BOT "Main Antenna" Mobile RF (GSM/LTE etc.)

Here we continue to notice that:

The external antenna jack is connected to the mobile "Main Antenna".

The left-hand-side internal RF jack is connected to the "Diversity Antenna".

The right-hand-side internal RF jack may be connected to the "Wifi Antenna",

on the back, or something else...

According to Google, a "Diversity Antenna" is part of an intelligent

multi-antenna system that senses the incoming signals to automatically

select the antenna best positioned to receive it...

A more clear description can be found HERE.

Now, let's wildly speculate about this design. Many phones have their main

antennas in the bottom. Check! Then, since this device was meant to be carried

in the pocket, which mostly means back-pocket, with the screen towards your

body, because of shape. The Wifi signal need to go through your body, and thus

antenna should be on the screen side. Check! Then if you're to recive any

external/GPS signal at all, you'd like the antenna to be pointed on the

outside, which means on the backside of the PCB. Check!

All-in-all, we have 6 antenna connectors!

Beyond the event horizon

Next, you have 4 Torx (T5?) screws around the corners and 2 more behind the

battery, to undo. Then you can gently push into the holes, and the front

screen will hopefully come out (?) and should not have any other attached

connections.

I leave the rest up to you (or to me for a much later date), to fill in the

remaining blanks and post some internal pictures...

In the meantime, you can look at these internal pictures, that I obtained

from the FCC website and searching for FCCID: QIS E589U-512.

Front Side PCB.

As you can see on the front side we the following:

- 2-7 test points

- Chips:

(1) Toshiba TC58NYG1S3C NAND flash chip

(2) Qualcomm

(3)

Back Side PCB.

Here you can see:

- 2 internal RF connectors

- a 4G external RF antenna connector (See one HERE.)

- JTAG pads in typical Huawei layout of 10 pads in line (See HERE)

- Possible UART/Serial islands (5 pads)

< More Dragons TBA >