Author Topic: EEVblog #547 - Dumpster Phone Teardown  (Read 14975 times)

0 Members and 1 Guest are viewing this topic.

Online EEVblog

  • Administrator
  • *****
  • Posts: 29971
  • Country: au
    • EEVblog
EEVblog #547 - Dumpster Phone Teardown
« on: November 13, 2013, 12:38:02 am »
Dave tears down and salves some parts from old Panasonic, Telstra, Cisco, Nortel, and Polycom PABX and VOIP phones found in the dumpster.
Are there any salvageable parts in them?

 

Offline nitro2k01

  • Frequent Contributor
  • **
  • Posts: 844
  • Country: 00
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #1 on: November 13, 2013, 01:06:19 am »
What about look at that grill through a microscope? And if you're feeling adventurous, maybe an attempt to reverse engineer one of the graphical LCDs? (Like the one 10:40 in the video.)
Whoa! How the hell did Dave know that Bob is my uncle? Amazing!
 

Offline NiHaoMike

  • Super Contributor
  • ***
  • Posts: 5610
  • Country: us
  • "Don't turn it on - Take it apart!"
    • Facebook Page
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #2 on: November 13, 2013, 02:42:00 am »
The IP phones might be hackable, especially the ones that run Linux based firmware.
Cryptocurrency has taught me to love math and at the same time be baffled by it.

Cryptocurrency lesson 0: Altcoins and Bitcoin are not the same thing.
 

Offline rain

  • Contributor
  • Posts: 5
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #3 on: November 13, 2013, 04:23:15 am »
The sidecar for the Polycom phones actually only transmits power over the 2 wire slide connector -- for some reason they decided to use IR to transmit between the phone and the sidecar.  You can see the IR modules (one on each side) by Dave's hands at ~8:25

The IP phones might be hackable, especially the ones that run Linux based firmware.
I'm pretty sure none of the IP phones featured run Linux -- they've got relatively wimpy processors since most of their life is spent playing a single 8000Hz audio stream
« Last Edit: November 13, 2013, 04:26:43 am by rain »
 

Online EEVblog

  • Administrator
  • *****
  • Posts: 29971
  • Country: au
    • EEVblog
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #4 on: November 13, 2013, 04:37:13 am »
The sidecar for the Polycom phones actually only transmits power over the 2 wire slide connector -- for some reason they decided to use IR to transmit between the phone and the sidecar.  You can see the IR modules (one on each side) by Dave's hands at ~8:25

Yes, in my hasty teardown I missed that completely.
 

Offline Bored@Work

  • Super Contributor
  • ***
  • Posts: 3932
  • Country: 00
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #5 on: November 13, 2013, 06:17:59 am »
Small correction. At 5:15
Quote from: EEVblog
Nortel are huge.

No, Nortel are dead.

Bankrupt in 2009, closed or sold most of their stuff piecemeal. The remains aren't worth to mention.
I delete PMs unread. If you have something to say, say it in public.
For all else: Profile->[Modify Profile]Buddies/Ignore List->Edit Ignore List
 

Offline HamiltonHipster

  • Contributor
  • Posts: 14
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #6 on: November 13, 2013, 07:13:28 am »
Hi Dave,
  The speakers, especially the assembly with the bassport, look like a good opportunity to have a look at the frequency response and harmonic distortion of speakers...

Would you use the DSA measure these things?

:)

 

Offline Kjelt

  • Super Contributor
  • ***
  • Posts: 5698
  • Country: nl
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #7 on: November 13, 2013, 07:55:55 am »
@5.34 
Quote
1000V 16uF
???  would that perhaps be a 1000uF 16V  ;)
 

Offline chip273

  • Contributor
  • Posts: 12
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #8 on: November 13, 2013, 08:13:25 am »
I didn't know so many phones would use standard hitachi controller LCD boards. I always assumed they all would use some custom LCD's with no chance of reuse. Thanks for that info Dave !
 

Online daqq

  • Super Contributor
  • ***
  • Posts: 1593
  • Country: sk
    • My site
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #9 on: November 13, 2013, 08:44:35 am »
Nice post.

Minor correction: The encoders in phone #1 are not optical, they are mechanical such as these ones: http://www.sos.sk/a_info/resource/a/pdf/ec11.pdf
Far cheaper, far easier to use.
Believe it or not, pointy haired people do exist!
+++Divide By Cucumber Error. Please Reinstall Universe And Reboot +++
 

Offline nathanpc

  • Supporter
  • ****
  • Posts: 138
  • Country: br
    • Innove Workshop
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #10 on: November 13, 2013, 03:56:28 pm »
I really like these dumpster teardown/salvage videos, it's incredible the amount of stuff that you can get from the trash.

I didn't know so many phones would use standard hitachi controller LCD boards. I always assumed they all would use some custom LCD's with no chance of reuse. Thanks for that info Dave !

I thought the same thing. It's incredible how popular they are.
 

Offline DutchGert

  • Frequent Contributor
  • **
  • Posts: 257
  • Country: nl
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #11 on: November 13, 2013, 04:42:38 pm »
What are those rectangular pads on the Cisco board (from 14:17)? I also seen them on a Intel Ethernet board but what are they for? There are not grounded, no via's in them, just floating square pads with solder mask on them.
 

Offline fcb

  • Super Contributor
  • ***
  • Posts: 1269
  • Country: gb
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #12 on: November 13, 2013, 05:13:21 pm »
Fiducial's for vision recognition.
 

Offline DutchGert

  • Frequent Contributor
  • **
  • Posts: 257
  • Country: nl
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #13 on: November 13, 2013, 05:27:56 pm »
Fiducial's for vision recognition.

Dont think so, whole board is covered with them and they have solder mask on them
 

Offline NiHaoMike

  • Super Contributor
  • ***
  • Posts: 5610
  • Country: us
  • "Don't turn it on - Take it apart!"
    • Facebook Page
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #14 on: November 13, 2013, 05:29:41 pm »
I'm pretty sure none of the IP phones featured run Linux -- they've got relatively wimpy processors since most of their life is spent playing a single 8000Hz audio stream
It's pretty common to find $10 wireless routers running Linux.
Cryptocurrency has taught me to love math and at the same time be baffled by it.

Cryptocurrency lesson 0: Altcoins and Bitcoin are not the same thing.
 

Offline killy

  • Newbie
  • Posts: 1
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #15 on: November 13, 2013, 06:51:58 pm »
Whoa! This episode became almost mike's-fast :)
Dave, can you put some board photos to flickr, please?
 

Offline Kjelt

  • Super Contributor
  • ***
  • Posts: 5698
  • Country: nl
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #16 on: November 13, 2013, 07:33:20 pm »
What are those rectangular pads on the Cisco board (from 14:17)? I also seen them on a Intel Ethernet board but what are they for? There are not grounded, no via's in them, just floating square pads with solder mask on them.
yeah wondering the same thing, only thing I can think of is that this is cheaper for the pcb manufacturer because they don't have to edge all that copper away, if you produce hundreds of thousands of these pcb's that can save quite some money on the edging fluids. And if there is a mistake in the pcb you can add some fixes on these pads but then naaaaah.
 

Offline NickS

  • Supporter
  • ****
  • Posts: 54
  • Country: au
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #17 on: November 13, 2013, 10:53:21 pm »
It's pretty common to find $10 wireless routers running Linux.
Actually virtually every consumer router is Vxworks or Linux.

As for phones it depends on the complexity of the phone if they would go for Linux or not.
I'm pretty sure my Gigaset VoIP phones use Linux (or equivalent) however they have a full web interface where some of these phones would not.
 

Offline jh15

  • Frequent Contributor
  • **
  • Posts: 455
  • Country: us
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #18 on: November 14, 2013, 12:15:57 am »
How do I get started firing up those standard LCDs?  I have some arduinos kicking ariund.
Tutorials and data sheets links anyone?



tek 575 curve tracer top shape, 535 top shape, 465. 545 hickok clone, Telsa Model S,  Ohio Scientific c24P single board computer, many c-64 from my club days, Giant electric bicycle, Rigol stuff, Heathkit AR-15 receivers 2, Heathkit et 3400a trainer and interface,
 

Offline calexanian

  • Super Contributor
  • ***
  • Posts: 1873
  • Country: us
    • Alex-Tronix
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #19 on: November 14, 2013, 12:28:37 am »
At some point a friend of mine had something to do with the audio quality at polycom. I have no idea if this was one of his designs with the seperate enclosure and the fancy bit over the mic, but I would not dobut it. He specialized in that sort of thing and whoever took over after he left kept on going with some good stuff.
Charles Alexanian
Alex-Tronix Control Systems
 

Offline Atreidae

  • Contributor
  • Posts: 19
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #20 on: November 14, 2013, 12:53:42 am »
The sidecar for the Polycom phones actually only transmits power over the 2 wire slide connector -- for some reason they decided to use IR to transmit between the phone and the sidecar.  You can see the IR modules (one on each side) by Dave's hands at ~8:25

Looks like Rain beat me to it, Poly continued this trend even on their newer colour sidecars too.. We always assumed it was some sort of isolation thing but it doesnt make much sense does it?

Ill add too that the order Dave reviewed the phones in was not the order they were produced in.. I didnt get a good look but the handsets looked like an

IP 301. a lower end early IP Phone from Polycom
IP 330 or 331, Midrange "current" generation phone there were also more powerfull processor and audio wise supporting a massive 22khz!
IP 501 High end phone of the same series as the 301

Dave's commend about "they learned their lesson" re the double sided load wouldn't apply as the 501 is an older unit than the 33x

Just realized, I'm apparently a phone nazi

Interesting fact the early x01 series were notorious for rebooting whist using speakerphone and powering them via 802.3af (Normal PoE)

It's pretty common to find $10 wireless routers running Linux.
Actually virtually every consumer router is Vxworks or Linux.

As for phones it depends on the complexity of the phone if they would go for Linux or not.
I'm pretty sure my Gigaset VoIP phones use Linux (or equivalent) however they have a full web interface where some of these phones would not.

The Polycoms are actually pretty complicated from a software prospective, upon bootup they will grab provisioning details via DHCP option 66, connect to an FTP/TFTP server and download their firmware, flash themselves, reboot, download their config and register to whatever PABX / SIP provider you are using (most commercial sip phones do this regardless) The Polycoms also have multiple stages of firmware, suggesting an OS + app so perhaps something like Vxworks or a linux kernel. They also have a built in webserver for reconfiguration and the ability to change VLAN tagging in the switch.. so alot of stuff to program from scratch.

I could go on about these phones for hours but I need to get some work done :)
« Last Edit: November 14, 2013, 01:02:23 am by Atreidae »
 

Offline Rasz

  • Super Contributor
  • ***
  • Posts: 2279
  • Country: 00
    • My random blog.
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #21 on: November 14, 2013, 01:53:08 am »
I'm pretty sure none of the IP phones featured run Linux -- they've got relatively wimpy processors since most of their life is spent playing a single 8000Hz audio stream
It's pretty common to find $10 wireless routers running Linux.

Cheapest router boards start at ~$15 for really low end, and cheapest routers start at $20.
Cisco phones run VxWorks, there are many attack vectors for them including using one as a remote listening device over the network.
Who logs in to gdm? Not I, said the duck.
My fireplace is on fire, but in all the wrong places.
 

Offline Atreidae

  • Contributor
  • Posts: 19
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #22 on: November 14, 2013, 04:05:47 am »
...Cisco phones run VxWorks, there are many attack vectors for them including using one as a remote listening device over the network...

I remember when I was trialing large Multifunction printers for a government department we had one of the devices malfunction in weird ways.. When the engineer came out and plugged his laptop into the console I't kept printing ascii art instead of debug info. Turns out it was a Virus targeted towards Vxworks
 

Offline Stonent

  • Super Contributor
  • ***
  • Posts: 3824
  • Country: us
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #23 on: November 14, 2013, 10:38:55 am »
How do I get started firing up those standard LCDs?  I have some arduinos kicking ariund.
Tutorials and data sheets links anyone?

Pretty easy:

http://arduino.cc/en/Tutorial/LiquidCrystal

Martin's video (the first one) talks more about serial LCDs but the parallel ones are more common and cheaper. The second video by Derek Malloy focuses on parallel displays which are most like what Dave salvaged from the phones.
As long as they LCD are using the Hitachi style interface, they're pretty easy. The third video by Jeremy Blum is pretty good also. Jeremy's videos are what got me started with Arduino.





« Last Edit: November 14, 2013, 11:32:53 am by Stonent »
The larger the government, the smaller the citizen.
 

Offline rsjsouza

  • Super Contributor
  • ***
  • Posts: 3469
  • Country: us
  • Eternally curious
    • Vbe - vídeo blog eletrônico
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #24 on: November 14, 2013, 10:02:46 pm »
The TMS320VC5472 (Orion) is an ARM7 + C54x DSP designed for IP phones (some news releases here and here). It probably runs uCLinux or maybe Nucleus, QNX or VxWorks RTOS.

The TNETV1055 is a newer generation device with a MIPS and a C55x DSP and a boatload of peripherals.

The TMS320VC5402 is a DSP-only device...
Vbe - vídeo blog eletrônico http://videos.vbeletronico.com

Oh, the "whys" of the datasheets... The information is there not to be an axiomatic truth, but instead each speck of data must be slowly inhaled while carefully performing a deep search inside oneself to find the true metaphysical sense...
 

Online mariush

  • Super Contributor
  • ***
  • Posts: 3823
  • Country: ro
  • .
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #25 on: November 14, 2013, 10:09:48 pm »
Quote
How do I get started firing up those standard LCDs?  I have some arduinos kicking ariund.
Tutorials and data sheets links anyone?

In addition to Stonent's comment, see newbiehack.com's series of videos about microcontrollers and lcd displays :

http://newbiehack.com/VideoClipsList.aspx?category=LCD

Click on each link , then click on those pictures with skeleton head to see the video.

Or go directly to the youtube channel for the whole series with microcontrollers :

https://www.youtube.com/playlist?list=PLE72E4CFE73BD1DE1

 

Offline DutchGert

  • Frequent Contributor
  • **
  • Posts: 257
  • Country: nl
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #26 on: November 15, 2013, 07:51:27 am »
What are those rectangular pads on the Cisco board (from 14:17)? I also seen them on a Intel Ethernet board but what are they for? There are not grounded, no via's in them, just floating square pads with solder mask on them.
yeah wondering the same thing, only thing I can think of is that this is cheaper for the pcb manufacturer because they don't have to edge all that copper away, if you produce hundreds of thousands of these pcb's that can save quite some money on the edging fluids. And if there is a mistake in the pcb you can add some fixes on these pads but then naaaaah.

Anyone?
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 6539
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #27 on: November 15, 2013, 12:49:23 pm »
The Polycoms are actually pretty complicated from a software prospective, upon bootup they will grab provisioning details via DHCP option 66, connect to an FTP/TFTP server and download their firmware, flash themselves, reboot, download their config and register to whatever PABX / SIP provider you are using (most commercial sip phones do this regardless) The Polycoms also have multiple stages of firmware, suggesting an OS + app so perhaps something like Vxworks or a linux kernel. They also have a built in webserver for reconfiguration and the ability to change VLAN tagging in the switch.. so alot of stuff to program from scratch.

I could go on about these phones for hours but I need to get some work done :)
AFAIR they run Vxworks and there's a serial port on the board somewhere you can play with. (I never got around to RE'ing one a while back...)
 

Offline greatal

  • Contributor
  • Posts: 6
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #28 on: November 15, 2013, 06:03:54 pm »
Hi Dave
About this time tear down you always can salvage some ram and Flash chips from IP phones to upgrade your Linux base router or other devices
Good luck
 

Offline jh15

  • Frequent Contributor
  • **
  • Posts: 455
  • Country: us
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #29 on: November 16, 2013, 02:14:46 am »
Thanks for the lcd replies. I can't imagine the number of them in our town's electronic waste dropoff day tomorrow. Don't think they've had one for 3 years... Now I'll have to look at the stack of printers I am going to toss for a lcd patient.
tek 575 curve tracer top shape, 535 top shape, 465. 545 hickok clone, Telsa Model S,  Ohio Scientific c24P single board computer, many c-64 from my club days, Giant electric bicycle, Rigol stuff, Heathkit AR-15 receivers 2, Heathkit et 3400a trainer and interface,
 

Offline Stonent

  • Super Contributor
  • ***
  • Posts: 3824
  • Country: us
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #30 on: November 16, 2013, 10:29:19 pm »
Thanks for the lcd replies. I can't imagine the number of them in our town's electronic waste dropoff day tomorrow. Don't think they've had one for 3 years... Now I'll have to look at the stack of printers I am going to toss for a lcd patient.

Make sure to post back with pics and or video of your findings.
The larger the government, the smaller the citizen.
 

Offline Atreidae

  • Contributor
  • Posts: 19
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #31 on: November 18, 2013, 01:33:06 am »
AFAIR they run Vxworks and there's a serial port on the board somewhere you can play with. (I never got around to RE'ing one a while back...)

Its quite possibly the accessory port, as as far as I know its serial. Look for a little 5 pin female header accessible from the back of the phone.
The phone Tx's Serial data on this line to control headsets and the like.

Might be worth me trying to look at those ports at some stage..
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 6539
Re: EEVblog #547 - Dumpster Phone Teardown
« Reply #32 on: November 18, 2013, 08:59:00 am »
AFAIR they run Vxworks and there's a serial port on the board somewhere you can play with. (I never got around to RE'ing one a while back...)

Its quite possibly the accessory port, as as far as I know its serial. Look for a little 5 pin female header accessible from the back of the phone.
The phone Tx's Serial data on this line to control headsets and the like.

Might be worth me trying to look at those ports at some stage..
Not that one, it's not accessible without removing the back case as it's on the main PCB itself.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf