Difference between revisions of "Micro-USB Interface Controller"

From postmarketOS
Jump to navigation Jump to search
m (fix link)
m (Add some more info about 525 vs 619 kohm)
 
(7 intermediate revisions by 3 users not shown)
Line 1: Line 1:
 
{{todo|Add more information (which devices have one, how they are useful to us, what do jig and boot do, etc.)}}
 
{{todo|Add more information (which devices have one, how they are useful to us, what do jig and boot do, etc.)}}
  
A Micro-USB Interface Controller (MUIC) is a USB multiplexer/switch. (Not a USB Host Controller like the name might imply)
+
A Micro-USB Interface Controller (MUIC) is a USB multiplexer/switch. (Not a USB Host Controller like the name might imply).
 +
 
 +
On somewhat recent Samsung models we have:
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 21: Line 23:
 
|Active
 
|Active
 
|}
 
|}
 +
 +
Both 523 kohm and 619 kohm gives serial output and let us access the SBOOT shell.
  
 
== Tested configurations ==
 
== Tested configurations ==
Line 30: Line 34:
 
! rowspan="2" |Device
 
! rowspan="2" |Device
 
! rowspan="2" |MUIC
 
! rowspan="2" |MUIC
 +
! rowspan="2" |Voltage (VCC)
 
! colspan="3" |Resistance
 
! colspan="3" |Resistance
 
|-
 
|-
Line 38: Line 43:
 
|[[Samsung Galaxy Grand Neo (samsung-baffinlite)]]
 
|[[Samsung Galaxy Grand Neo (samsung-baffinlite)]]
 
|FSA9485
 
|FSA9485
|P <ref>Got some output with it once, but it doesn't seem to auto-wake the device.</ref>
+
| 3.3v
 +
|Y
 
|
 
|
 
|Y
 
|Y
Line 44: Line 50:
 
|[[Google Galaxy Nexus GSM (samsung-maguro)]]
 
|[[Google Galaxy Nexus GSM (samsung-maguro)]]
 
|FSA9480
 
|FSA9480
 +
|
 
|
 
|
 
|
 
|
Line 50: Line 57:
 
| [[Samsung Galaxy Mini 2 (samsung-s6500d)]]
 
| [[Samsung Galaxy Mini 2 (samsung-s6500d)]]
 
|FSA9280
 
|FSA9280
 +
|
 
|
 
|
 
| Y
 
| Y
Line 55: Line 63:
 
|-
 
|-
 
| [[Samsung Galaxy S4 Mini LTE]]
 
| [[Samsung Galaxy S4 Mini LTE]]
 +
|
 
|
 
|
 
|
 
|
Line 60: Line 69:
 
| Y
 
| Y
 
|-
 
|-
| [[Samsung Galaxy S5 (samsung-klte)]]
+
| Samsung Galaxy [[Samsung Galaxy S5 (samsung-klte)|S5]], [[Samsung Galaxy S6 (samsung-zerofltexx)|S6]], [[Samsung Galaxy S7 (samsung-herolte)|S7]], and plus/edge versions
 +
|
 
|
 
|
 
|
 
|
Line 67: Line 77:
 
|-
 
|-
 
| [[Samsung Galaxy Note 3 (samsung-hlte)]]
 
| [[Samsung Galaxy Note 3 (samsung-hlte)]]
 +
|
 
|
 
|
 
|
 
|
Line 73: Line 84:
 
|-
 
|-
 
| [[Samsung Galaxy S III mini (samsung-golden)]]
 
| [[Samsung Galaxy S III mini (samsung-golden)]]
 +
|
 
|
 
|
 
|
 
|
Line 79: Line 91:
 
|-
 
|-
 
| [[Samsung Galaxy Xcover 2 (samsung-skomer)]]
 
| [[Samsung Galaxy Xcover 2 (samsung-skomer)]]
 +
|
 
|
 
|
 
|
 
|
Line 85: Line 98:
 
|-
 
|-
 
| [[Samsung Galaxy Note 8.0 (Wi-Fi) (samsung-n5110)]]
 
| [[Samsung Galaxy Note 8.0 (Wi-Fi) (samsung-n5110)]]
 +
|
 
|
 
|
 
|
 
|
Line 90: Line 104:
 
| Y
 
| Y
 
|-
 
|-
|[[Samsung Galaxy Tab S 10.5 WiFi (samsung-chagallwifi)]]
+
| Samsung Galaxy Tab S (all variants, i.e. [[Samsung Galaxy Tab S 10.5 WiFi (samsung-chagallwifi)|[1]]], [[Samsung Galaxy Tab S 10.5 LTE (samsung-chagalllte)|[2]]], [[Samsung Galaxy Tab S 8.4 LTE (samsung-klimtlte)|[3]]], [[Samsung Galaxy Note 10.1 2014 (samsung-n1awifi)|[4]]])
 +
|
 +
|
 +
|
 +
|
 +
| Y
 +
|-
 +
| [[Samsung Galaxy Y (samsung-totoro)]]
 +
| integrated into PMIC (MAX8986, MAX232)
 +
| 1.8v
 +
|
 +
| Y
 +
| Y
 +
|-
 +
| [[Samsung Galaxy Tab 3 10.1 3G (samsung-santos103g)]]
 +
|
 
|
 
|
 
|
 
|
Line 117: Line 146:
 
= Links =
 
= Links =
  
[[Serial_debugging#USB_debug_cable]]
+
[[Serial_debugging:Cable_schematics#USB_debug_cable]]
  
 
[https://greatscottgadgets.com/infiltrate2013/ Multiplexed Wired Attack Surfaces]
 
[https://greatscottgadgets.com/infiltrate2013/ Multiplexed Wired Attack Surfaces]

Latest revision as of 17:20, 28 April 2021

TODO Add more information (which devices have one, how they are useful to us, what do jig and boot do, etc.)

A Micro-USB Interface Controller (MUIC) is a USB multiplexer/switch. (Not a USB Host Controller like the name might imply).

On somewhat recent Samsung models we have:

UART Modes
Resistance Jig Boot
150k Inactive Inactive
523k Active Inactive
619k Active Active

Both 523 kohm and 619 kohm gives serial output and let us access the SBOOT shell.

Tested configurations

TODO Add more devices and fill in missing MUICs
Device MUIC Voltage (VCC) Resistance
150K 523K 619K
Samsung Galaxy Grand Neo (samsung-baffinlite) FSA9485 3.3v Y Y
Google Galaxy Nexus GSM (samsung-maguro) FSA9480 Y
Samsung Galaxy Mini 2 (samsung-s6500d) FSA9280 Y
Samsung Galaxy S4 Mini LTE Y
Samsung Galaxy S5, S6, S7, and plus/edge versions Y
Samsung Galaxy Note 3 (samsung-hlte) Y
Samsung Galaxy S III mini (samsung-golden) Y
Samsung Galaxy Xcover 2 (samsung-skomer) Y
Samsung Galaxy Note 8.0 (Wi-Fi) (samsung-n5110) Y
Samsung Galaxy Tab S (all variants, i.e. [1], [2], [3], [4]) Y
Samsung Galaxy Y (samsung-totoro) integrated into PMIC (MAX8986, MAX232) 1.8v Y Y
Samsung Galaxy Tab 3 10.1 3G (samsung-santos103g) Y
Legend
Y Tested, works
P Tested, partially works
N Tested, doesn't work
Untested


Links

Serial_debugging:Cable_schematics#USB_debug_cable

Multiplexed Wired Attack Surfaces

Wikipedia: CEA-936-A

CEA-936-A USB Carkit Specification Preview

Datasheets

FSA9288A

FSA9480

MC34827