Computer Security Rants & Reverse Engineering

Saturday, September 29, 2012

Oval Elephant UG802 with RK3066 CPU

I picked up a UG802 from Oval Elephant a week or so ago, this is one of a number of so called Android Mini PCs, such as the MK802, that have appeared out of China in the last few months. These devices are based on low/mid end Android cellphone hardware, with the screen replaced with an HDMI connector and no battery. The intended application for these devices is to add internet (smart) functionality to TV sets. The UG802 is notable in that it uses a more modern Cortex A9 dual core processor. On the whole I've found the device to be quite usable, especially after rooting and changing the default launcher.

From looking around I'm confident that the UG802 hardware is also sold under a bunch of other name/model combinations, so if you have a similar device with a RK3066 chip in, its likely the same or very similar hardware.

I looked around and couldn't find any decent pictures of the internals of the device, so I decided to take it apart and make a few board scans. Also, the pictures on OvalElephant lead me to believe there were likely a number of test points around the CPU worth investigating -- more on that later.

Disassembling the device is a pain in the butt, as its held together with a number of rather fragile plastic clips. For anyone looking to take theirs apart, the clips extend from the smaller of the two halves. I worked from near the sides of the HDMI port out, using hotel key cards as pry bars and shims. A technique I've proved effective a number of times in the past, worked reasonably well here. However, I required a bit of screw driver prying as the case is quite snug.


Huge versions can be found here, front and back.

For an inexpensive device I was rather impressed with the finish on the boards. The soldering is clean and and the component placement well done. The only issue I observed was a poor routing on the antenna cable, which caused it to be pinched by the case. Mine was severed, but the insulation and some of the shielding was cut. I suspect if people are having issues with WiFi reception, this is a likely cause.

While I had the device open, I grabbed the oscilloscope and checked out the test pads around the CPU. I was able to locate a serial boot console, which could be useful for development and anti-bricking purposes.
The color coding for the pins is as follows:
  • Green = Ground
  • Blue = Serial TxD
  • Red = Serial RxD
  • White = No signal
  • Yellow = 3.3V
  • Magenta = 2.5V
The serial connection is the expected 3.3V at 115,200bps. A log from the boot process is available here. Regrettably, I didn't take the time to see if the bootloader had an interactive mode. I'll make a dump of the bootloader and examine it, see if there is anything interesting or useful there.

I'm guessing the unpopulated TO92 package is intended to be an IR receiver, but that's only a guess.

The use of the other pins is less clear, I'm guessing that by either pulling some set high or low, the device can be placed in a factory flash/recovery mode, however more time with the CPU datasheet and experimentation required to figure this out.