Might need help getting ADB/Shell on Presto A3 Restaurant Kiosk Tablet :)

[spencerlinn]

So... I've acquired a most unique embedded computing device at one of my local computer surplus/salvage places, and I've been having fun trying to get access to... well, anything on it. I figured since it runs Android, and I've done some Android development in the past, I'd like to use the device for a school project instead of the Samsung Galaxy Tab we're currently using.

So far, I've discovered that the device has a SATA port right below the battery with a rubber cover, very much resembling a "service" port. I suspected that it wasn't actually a SATA interface since, as far as I know, that would be quite costly to implement on an Android device that doesn't use it except in rare service instances. Pins 1, 4 and 7 should normally be ground on SATA, but I found only pin 4 was grounded on this suspicious service SATA connector. What I then did was cut up an old SATA cable and hook up each of the pins to my Saleae logic analyzer to see what I could find. The first thing I found is that on all the SATA cables I have, pins 1, 4, and 7 are all grounded internally in the cable... because merely plugging in the SATA cable caused the device to respond as the volume down button being pressed. Plugging in the cable before powering it on puts it into some kind of safe mode/bootloader mode (which makes sense as holding volume down while powering on is a common mechanic to achieve this on phones and other android devices...) but of the 4 remaining "data" pins, only one actually shows any activity, which makes me think it isn't just a USB interface being exposed on this SATA port (since USB should show differential signaling on two wires, correct?) I've spent a good while trying different analyzers in the Logic app and the only thing I've found that seems to decode anything is "1 wire", but I have no idea why this would be using a 1-wire interface for "service"... it really seems most likely that they'd use this SATA port to expose a USB client interface since this is really an android device and plugging in a SATA cable even puts it in recovery mode.

Also, I have only been able to capture at 8Ms/s for some reason.. my Saleae is kinda old, USB 2.0 model, but I would have thought it would still capture at 24Ms/s as the app suggests, don't know if that's a limit on finding out what this is.

If anyone has any tips on how I can approach finding out what protocol this is or perhaps recognizes it, I would be super stoked!

I've attached the Logic capture data and some pictures and screenshots to show what's going on. Note: The capture shows two boot sequences. The first goes until about 5s after which the device pulls channel 3 high for the remainder of that boot, then I reboot it at about 30s and it repeats the process. In other words, only the first 5s or so is valuable.

[spencerlinn]

Update:

I got to thinking, since I'm pretty sure this device is trying to write to a serial console, maybe it's actually serial.. like RS232 serial, as opposed to a UART. I figured given that these devices run at considerably lower voltages than PCs from the 90's (back when RS232 was standard fare lol) that, best case scenario I'd be dealing with a UART. Turns out, it actually is RS232 (or at least 5V TTL with the inverted logic of RS232...) because connecting up to a USB-Serial adapter and setting to 115200 8 n 1 (as implied by Logic's "autobaud" feature) immediately spewed out some text upon boot:

Code: [Select]

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2.C2-00028
S - IMAGE_VARIANT_STRING=DAASANAZA
S - OEM_IMAGE_VERSION_STRING=bldserver3
S - Boot Config, 0x000000e1
B -      1566 - PBL, Start
B -      4542 - bootable_media_detect_entry, Start
B -     84322 - bootable_media_detect_success, Start
B -     84326 - elf_loader_entry, Start
B -     85563 - auth_hash_seg_entry, Start
B -    109710 - auth_hash_seg_exit, Start
B -    123745 - elf_segs_hash_verify_entry, Start
B -    182787 - PBL, End
B -    151311 - SBL1, Start
B -    196206 - boot_flash_init, Start
D -         0 - boot_flash_init, Delta
B -    201361 - boot_config_data_table_init, Start
D -      2379 - boot_config_data_table_init, Delta - (0 Bytes)
B -    209108 - CDT version:3,Platform ID:11,Major ID:4,Minor ID:0,Subtype:4
B -    214750 - pm_device_init, Start
B -    217190 - pm_device_init, TEST - MSM8909 detected
B -    221338 - pm_device_init, INFO - PM8909 is selected
B -    234423 - PM_SET_VAL:Skip
D -     18849 - pm_device_init, Delta
B -    235826 - sbl1_ddr_set_params, Start
B -    238205 - cpr_init, Start
D -         0 - cpr_init, Delta
B -    243847 - Pre_DDR_clock_init, Start
D -       183 - Pre_DDR_clock_init, Delta
D -         0 - sbl1_ddr_set_params, Delta
B -    256779 - pm_driver_init, Start
B -    263489 - --> Charge init
B -      3752 - battery voltage
B -    266966 - boot up
B -        10 - Current status
D -     10675 - pm_driver_init, Delta
B -    279319 - clock_init, Start
D -       152 - clock_init, Delta
B -    697565 - Image Load, Start
D -    158051 - QSEE Image Loaded, Delta - (484976 Bytes)
B -    855647 - Image Load, Start
D -       335 - SEC Image Loaded, Delta - (2048 Bytes)
B -    864065 - ## gpio99 is high
B -    865254 - ##gpio99 is high
B -    868274 - sbl1_efs_handle_cookies, Start
D -       579 - sbl1_efs_handle_cookies, Delta
B -    876661 - Image Load, Start
D -     82137 - RPM Image Loaded, Delta - (156524 Bytes)
B -    958859 - Image Load, Start
D -    196634 - APPSBL Image Loaded, Delta - (640940 Bytes)
B -   1155492 - QSEE Execution, Start
D -       366 - QSEE Execution, Delta
B -   1161226 - SBL1, End
D -   1012203 - SBL1, Delta
S - Throughput, 37000 KB/s  (1284488 Bytes,  33942 us)
S - DDR Frequency, 400 MHz
Android Bootloader - UART_DM Initialized!!!





SAIO A-Boot (Secure) Ver_2.5 main menu:
------------------------------------------------
1) View configuration data
2) Enter fastboot mode (locked)
3) Launch OS
4) Reboot
------------------------------------------------
Enter selection:-->View config


saio_prd=PRESTO-A3
saio_ver=C02
saio_sn=PSTA3072018000432
saio_mfg=
saio_key=3082011802010002820100B15F743D783496B5FA74D77C975912DF580594584D329BD89
        F683492EA27AD66BC45CF318A384F88FD50EC85D3DBB560E989EF20B6A6B53BB9E98BD2D30EFD798
        4410D3A03348B3FCE64D61D37FE72D0A9374C81D4D59B6EBA3928D3BE5E3E868EDE4037BCC69E01D
        4DEBE4F8D01946EC5A00FB708D403B5E70DBDEAACA8EBDAF16AE46EA2A8805635AF1153176E101D0
        3F747DD4435B963AEAC889F17168EA898AE5D549D91582ACA2E7EAC2A10F463451B80F8E9FACE5DB
        A37DFD63B4EEB434D3E50E974AE61367EF007459AE0B7C29606B01D3F25A1CF366DAF067D946F968
        56479598436B2317A61E77F68AEA0DB3468CF4B5F7863C46394DD1F55439FD902030100010200020
        00200020002000200402D5361496F4170507349674E3D000000000004D2D673F1215B516D1AC03CD
        E881FDDB7A74264E91C99B12BBDF1099148CBF69B33F465086EFAEAA24A3BC4E56B7A4B1B9156FE1
        090CFCDF1FC7C49966C22D30EDF3E7A45B4127127A701E025F413CDA1105B09F042301F1B38AA298
        90C43E3DECCB9BB1D97458B299BE177D2B539F6CEE59053FC823793027B71B355CD7ACB2534A1FF5
        7DF8A3AFD8AF4D447F7E8A7418674A9D51CCB6DE1DF1DC30B9813E4C720A5BB6E638B1E81F910329
        A3F686FC28FC8184E17553B1EF39B509E0EF2DDA68735C117F61271469D07AF04E06DA0AB39A531B
        10768681CB8FBA8CE94A915283A7D07A649DD54DE0A4109584B22768B309CA3F68D5EC7EFCB5A71C
        0C5DFEB6DCA65BE75258977AA4F2EF7628593E7AB
saio_cfg=0x00000200,0x00065107,0xBB01001E
silent
tamper_filter
poweroff_on_tamper
passcode=29928E9AB06EFFCA


SAIO A-Boot (Secure) Ver_2.5 main menu:
------------------------------------------------
1) View configuration data
2) Enter fastboot mode (locked)
3) Launch OS
4) Reboot
------------------------------------------------
Enter selection:-->Launch OS




Now, what I can do with this... doesn't seem like much. It displays some config info but won't allow fastboot (says "Fastboot is locked").
Launching OS doesn't work either, although that could be due to having the volume button depressed (by the cable).

[PlainName]

like RS232 serial, as opposed to a UART

Other than in the voltage specs, how does RS232 serial differ from a UART?

[spudboy488]

Other than in the voltage specs, how does RS232 serial differ from a UART?

RS232 is the physical layer (voltage specs, etc.) and UART is the message layer (Baud, start/stop bits, etc.)

[PlainName]

That's what I thought but figured there might be some inference I hadn't picked up on, hence my question.

Although, if we're going to be pedants, 'UART' is the acronym for the device and has sod-all to do with the message layer

Come to that, what is your message layer? In OSI terms it would be the datalink layer, wouldn't it?