[LG Optimus 2x] sudden36:
Hi,

As there is apparently a little bit of misinformation about the baseband I decided to write a short FAQ, if you find anything thats wrong or is missing, feel free to correct me :)

DISCLAIMER

Messing with the baseband can permanently brick your device, but more important it could harm yourself, someone else or could be illegal in your country. By reading this FAQ you agree that you act on your own risk and I am not responsible if you kill your phone, yourself, your dog or if you get arrested.

What does the baseband do?

The baseband(often also called modem,radio or CP (Cellular Processor) on other phones) is a set of chips which is responsible for handling all the communication with the mobile Network. It recieves the radio signals with the antenna, decodes it and sends it to the main processor( also called AP, which stands for Application Processor). The connection between the two processors carries the audio data from a phone call and the data you when you access the Internet. On the Android side the connection is managed by a piece of software called RIL. The chipset also has an own operating system, which leads us to the next question.

Why are there different baseband firmwares?

The different versions often contain bugfixes or improvements, however the most important part is different mobile operators have different networks and if you buy a phone from your mobile operator it most probably has a baseband optimized for your region. Another important point are the different hardware revisions of our phone which also can need different baseband software. So I recommend not to change your baseband if you bought your phone from your mobile operator! I changed it once and my download speed got very slow :( But if you bought it from ebay or somewhere else it might improve something. For more information read this excellent guide from tonyp.

Where is the baseband firmware stored?

The baseband chipset includes a second combined RAM/FLASH chip independent from the main RAM and FLASH connected to the Tegra2. To avoid confusion I will from now on call the RAM/FLASH of the baseband RAM2 and FLASH2. If I read the datasheet correctly the FLASH2 chip can store 128MB and the RAM2 has 64MB.

Can we hack/mod/flash our phone to use RAM2/FLASH2 for Android?

NO. There is simply no electrical connection between the main processor and the FLASH2/RAM2 thats fast enough to make it useful. In theory it would be possible to store a small amount of data in FLASH2, but we had to modify the baseband firmware (which will be very very difficult), the kernel and the ROM so it will not happen.

Now we get to the technical questions and some research I did:

Which baseband hardware does our phone have?

The baseband is manufactured by Infineon and the chipset is called X-GOLD 618 or XMM6180. You can find some sort of advertising brochure here.

The chipset itself consists of the following chips:

PMB8901: The basebands main processor with an ARM core.

PMB5703: The tranciever, containing ADC's and DAC's

Hynix H8BCS0QGMMR-46M: Contains RAM2 and FLASH2

There are also some smaller chips used for analog signal routing and processing.

How does the baseband firmware get into the FLASH2?

I think all who read this FAQ know how to flash a baseband firmware, but whats happening in detail?

First of all if you pull out the battery and press VOL-DOWN while inserting the USB cable the phone boots in a special "download mode". You can see the message "Software update, please wait...", I am not sure where the bootloader displaying this message is saved, but i think its the normal FLASH.

After you klick start in LG SmartFlash a HDLC encoded command is send to this bootloader, which allows the program to send commands to the baseband processor. Then SmartFlash uploads a bootloader to the RAM2 which I identified as MPEHS-Bootloader and which SmartFlash calls PSI RAM. from now on. This bootloader now accepts commands to write data to FLASH2. Altough it would be very interesting I didn't find a command to read data from FLASH2. I think FLASH2 in addition to the firmware contains interesting data, such as calibration settings, IMEI and probably the unlocking code to remove the simlock.

What do the *.fls files contain?

The *.fls files contain the firmware files for the baseband. There are multiple areas in FLASH2 which hold different parts of the firmware. I am not sure about the structure of the *.fls files so this what i got so far:

First there are 2 types of *.fls files, those who contain multiple binary images and those who contain only one binary image.

The binary images are always: psi ( I think MPEHS-Bootloader), slb(???), AENAS_FW(???), R375_SIC(probably the application + operating system). On all basebands which come as 4 files the psi and slb are identical.

Both types have a common header which is identical on single and multipart files. The header has yet to get described completely.

In all *.fls files i opened offset 0x3E7C contains the number of binary image files. Then follows some sort of table of the following format:

+0x10 .... file number
+0x0C .... file name
+0x80 .... next file number

and so on.

Identified binaries:

0x4744 size 0xD570 .... PSI RAM

Maybe anyone knows more about *.fls files and could expand this list.

What sort of software does the baseband processor run?

Well, this is a bit complicated to answer as the firmware is only available in binary form, but to our luck it isn't encrypted so the strings in the binary file do tell interesting stories ;)

On boot the processor executes a bootloader (Oh, what a suprise ;) ) which i think is called PSI (MPEHS Bootloader), which then maybe loads the operating system (ThreadX) and the application (the protocol stack to communicate with the mobile network).

Is the baseband firmware encrypted?

I don't think so :), because else I wouldn't have come so far. In addition I could already modify the baseband version string without causing an error, so I think there is not even a checksum or similar things.

This makes this phone ideal for hacking the baseband :)

Where did you get all this information?

Well mostly by reading the service manual, which can be googled easily.

A huge thanks goes to [MENTION=4414973]wkpark[/MENTION] for uploading this file and some others in this repository which helped a lot to understand the flashing protocol.

Then i found the following websites:

http://theiphonewiki.com/wiki/XMM_6180

http://fabiensanglard.net/cellphoneModem/index.php

The rest comes from binwalking the firmware files, a good hexeditor and playing man in the middle on the baseband firmware upgrade process.

Do you want to continue exploring the baseband?

Yes, of course ;) and I would be happy if anyone joined :)

I am currently working on a platform independent tool implementing LG's update protocol to flash the baseband and the ROM. It will also allow to emulate a phone to further investigate the flashing process without risking to brick a phone.

I hope this FAQ is useful for users, developers and people that also do some research on basebands.

good luck,

sudden36