Home telephone wiring in NZ

I had to perform some work on my home phone line including running new cable to a newly installed patch panel. I was suprised to notice that the existing cable had simply been twisted onto the incoming cable pair so this was quickly remedied.

Anyway, the incoming cable contained a single pair comprising of yellow and black wires. There had been several fingers in the pie and the cabling through the house was quite a mess, and figuring out the colour codes took a little bit of work, Here’s a guide for those living in an older NZ home who need to perform work on the phone line:

Cable Type Tip Ring
Incoming line Black Yellow
Existing house wiring Red White
Cat5 cable White(w/blue) Blue
Flexible phone leads Green Red

If you are still unsure, grab an LED and 10k resistor and connect the across the line. If it glows, the cathode is connected to tip and the anode to ring.

Connector Type Tip Ring
BS6312 (BT style) 5 2
RJ11 (6P6C) 4 3
RJ45 (8P8C) 5 4

HTC Wildfire S factory ROM update

A relative recently purchased a shiny new HTC Wildfire S from eking.co.nz. The phone itself is fantastic and I’ve had pretty good service from that site, however this particular Wildfire S turned up installed with a Chinese ROM, version 1.35.707. This version has loads of applications specific to China that cannot be removed and waste considerable space. I’m sure they are great for Chinese users but they are completely useless in New Zealand.

So the first step was to locate a suitable factory ROM image, so I decided on the European one. This took a bit of searching, but some ROMs are available from the following URLs. Note that the Wildfire S codename is Marvel (the original Wildfire codename is Buzz).


I went for the Shipped ROMs version which is an official RUU installer from HTC. This contains a European ROM image. I’ve also made a copy available for download below:

HTC_Marvel_Europe_10.35.3029H_7.46.35.08_release_185724_signed.zip (use for SD and GoldCard updates)
HTC Windows Drivers (install these when using Windows-based update)

ROM zip image MD5 sum:

Here’s the steps I tried to replace the factory firmware on the Wildfire S. While all three showed promise I ended up having to use the GoldCard method as the phone CID did not match that of the European firmware image, despite the fact that the images are signed by HTC.

If you purchased your phone from Eking and want to perform this I’d recommend going straight to attempt 3.

Note that I take no responsibility for any damage to your phone resulting from any of the instructions on this site!

The end result of the update was a fully functional phone with with an additional 60-70MB of internal storage freed up.

Attempt 1 – Official HTC Update Application (RUU)

My first attempt was to simply run the .exe file. Unfortunately this requires Windows but normally the process is fairly straightforward:

  1. Download and install HTC Sync.
  2. Ensure HTC Sync is not running or uninstall it and leave the HTC drivers installed.
  3. Power on the phone and enable USB debugging mode.
  4. Run the RUU application and follow the steps.

It did show that the update I was applying was actually a downgrade (v1.35.707 to v1.33.401) but it allowed me to proceed anyway. Unfortunately this failed after copying the image to the phone as it said the phone was the wrong type. After disconnecting the phone I powered it on and it still worked as before. Phew!

Attempt 2 – Flashing from the Boot Loader

The Wildfire S is like most HTC phones in that it can be forced to enter the boot loader by holding Volume Down when powering it on. From here it will look for a file named PG76IMG.zip on the root of SD card and attempt to load it if it exists, otherwise it will present the usual Android bootloader menu (text console with a picture of a three Androids at the bottom of the screen).

The neat thing about the Wildfire S supplied here is that it came already supplied in S-OFF mode.

The required zip file can be extracted from the HTC RUU application above. Don’t worry if the Windows built-in zip decompression doesn’t know how to open it; this does not mean that it is corrupt.

  1. Run the RUU application but leave it open at the welcome screen.
  2. Search your temp directory for a file called rom.zip and copy it to the SD card of the phone.
  3. Rename rom.zip to PG76IMG.zip.
  4. Close the RUU application.
  5. Unmount/safely eject the SD card (important!).
  6. Disable fast boot on the phone if it is enabled.
  7. Power off the phone and disconnect it from the USB port.
  8. Hold down the Volume Down button and power on the phone.
  9. When the bootloader screen appears it should locate the the ROM image file.
  10. Begin the update process when prompted.
  11. The phone will go through various update cycles and reboot itself several times.
  12. When the normal HTC splash screen appears it may take some time for the phone to finish booting; give it at least 10 minutes.

If you receive a message saying the update failed because of an incorrect CID (like I did) you will need to perform the GoldCard method below.

Attempt 3 – GoldCard Method

This method overrides the CID check on the phone.

  1. Format an SD card as FAT32 (if not already done).
  2. Boot the phone up with the SD card in it.
  3. Install GoldCard Helper from the Android Market and run it.
  4. Copy the CID.
  5. Visit http://psas.revskills.de/?q=goldcard and enter your email and CID. If you do this on the phone you can paste the CID from the GoldCard Helper app.
  6. When the email arrives it will have an attachment called goldcard.img. Save this somewhere on your computer.
  7. Connect the phone to the computer and mount the SD card on the computer.
  8. Copy the GoldCard image to the SD card.
    • If you use Linux, simply use dd to copy the GoldCard image onto the SD card. You will need to be root or use sudo for this. Also make sure you use the path to the SD card itself, not a partition on it. Mine was /dev/sdb but yours may differ.
      dd if=goldcard.img of=/dev/sdb bs=384
    • If you are stuck with Windows, download and install HxD Hex Editor.
    • Run HxD as Administrator (right-click and select Run as Administrator).
    • Go to Extras > Open Disk.
    • Select the physical SD device, not the logical one. Uncheck the read-only option and open it.
    • Open the goldcard.img file you received in another tab.
    • Select the entire contents of the GoldCard image and save it over the start of the SD device, address range 00000000 to 00000170. Save the changes and close HxD.
  9. Copy the ROM image to the root of the SD card and ensure it is named PG76IMG.zip.
  10. Unmount the SD card and disconnect the phone.
  11. Ensure the phone has fastboot disabled (change in Settings).
  12. Power off the phone.
  13. Hold down the Volume Down button and power it on.
  14. When the boot loader screen appears, release Volume Down.
  15. Confirm the update process when prompted.
  16. The phone will go through various update cycles and reboot itself several times.
  17. When the normal HTC splash screen appears it may take some time for the phone to finish booting; give it at least 10 minutes.
  18. Once the phone is back to normal operation, zero out the first 512 bytes of the SD card to destroy the GoldCard information.
    • In Linux simply run (as root), assuming your SD card is /dev/sdb:
      dd if=/dev/zero of=/dev/sdb bs=384 count=1
    • In Windows just use HxD to overwrite 00000000 through 00000170 with zeros and save.
  19. Enjoy!
  20. Make a donation to RevSkills for their awesome GoldCard generator.

Clarion and McIntosh parts

I recently had somebody refer me to PacParts who turn out to be an excellent source of spares for Clarion and McIntosh car audio. Parts include laser pickups, spindle motors, tuner modules, LCD/VFD displays, knobs and more.

Unfortunately they only ship to the US, however there are many companies around who offer international parcel forwarding such as Shipito.

Clarion CeNET – a first glance

I’m keen on reverse engineering at least some aspects of the Clarion CeNET bus in order to hook other gadgets to my car stereo. CeNET is a proprietary interconnect used by Clarion on many of their car audio products over the last ten years.

It uses a proprietary 13-pin square DIN style connector that is not available off the shelf. The pinout is shown below (this was taken from a Clarion service manual).

Electrically, CeNET appears to be a form of asymmetric serial bus. There is some discussion online that suggests a 38400 baud rate. The same person also says that it appears to use some form of encryption which may make it difficult to hack.

My experience with CeNET stereos is that the display will flash SYS or SYSTEM if the battery is disconnected or a CeNET device is inserted or removed. They do this until the stereo is powered on. Perhaps an encryption key is negotiated during that period?

On the hardware side, closer inspection reveals the bus consists of a transceiver IC (CA0008AM) connected to one of UARTs in the host devices microprocessor as shown in the simplified diagram below. Note that there are also some pull-down resistors on the Tx and Rx pins, as well as a 68 Ohm termination resistor across the Bus+ and Bus- pins. I’m unable to find data on the bus transceiver but I guess it’s possible that other generic ICs could be used here. The bus itself floats at 2.5v and swings +/- 200mV during signalling.

I have capture some data samples from a stereo connected to a EA-1251B iPod adapter that emulates a 6 disc changer. I haven’t yet studied them in detail but you can download the capture files below.

You will need to download Saleae Logic to view the capture files (it’s free). The cables were connected according to the colours in the diagram below:

In all captures I powered on the stereo from cold (no battery) immediately, then switched the unit on after about 3 flashes on the display (4-5 seconds). With the EA-1251 samples I switched from radio to the CD changer at about 7-9 seconds. From here the stereo waits for the iPod to wake up (it thinks the CD changer is loading) before it starts playing the first track of the first ‘disc’ (playlist) at about 14-15 seconds. The song then continues to play until the end of the capture.

Update: I’ve also grabbed a couple of samples of a TV tuner and display.

When the TV tuner is selected via the TV display it places the head unit into aux mode (it displays Aux on the screen). This could be a very useful hack; to make a ‘proper’ CeNet aux input. In the samples above, all units were powered up from cold (no battery) immediately after beginning the capture. The head unit is switched on at about 4 seconds, then there is a bit of wait for the display unit to boot up. Once this is done I’ve switched to the TV tuner at about 27 seconds. Shortly after (about 35 seconds) I switch back to the head unit’s internal FM radio.

It turns out trying to capture the bus pins was a waste of time as they normally float at 2.5V. I haven’t been able to look into that side of things any further as my only oscilliscope died before I could check it.

Hopefully somebody else finds this useful. I’ll keep working on it as I get time, and post any updates to the site if i come up with anything.

Vertical collapse on Storage System portable PC

I recently stumbled across a junked ‘Picollo’ portable PC made by Storage System Inc. This unit had a 66MHz 486 Overdrive processor and 10″ Sony Trinitron SVGA display and no doubt cost a fortune in its time.

Unfortunately the chassis had been partly gutted, missing the outer case and a variety of parts. The 10″ monitor still appeared to be salvageable however so I gave it a try.

After connecting everything as it appeared to go I connected a PC and powered on the display. Sadly the it was completely collapsed vertically, although I could make out enough detail in the thin line that appeared to be sure that it was otherwise functional.

The deflection is handled by the board mounted on top of the CRT. After fixing loads of dry joints around the horizontal output stage I decided to focus efforts around the vertical deflection stage.

This is based around an ST TDA1675A IC. I grabbed the datasheet for the IC and discovered that the circuit in the display was quite similar to the test circuit shown in the data sheet. The scope confirmed that the sync input was working, as well as the ramp generator. Unfortunately there was no output.

Google searching for the IC revealed many forum posts identifying this as a common cause of failure, and that it was also sensitive to failed components elsewhere in the vertical deflection circuit. Many people suggested replacing all of the surrounding capacitors and diodes as well as the IC just as a precaution.

TradeTech listed the IC as being on back order which was not ideal. In the mean time I though it would be worth attacking the other likely culprits in case the IC was still OK.

I replaced all of the electrolytics in the vertical stage as a matter of course but it didn’t fix the problem. I also identified a Zener diode (ZD201) with the marking ‘4A3’. After some research I found that this is in fact an HZ4A3, a 3.7V Zener. The closest I could get was a 3.6V 1N4729 so fitted one just in case. No difference.

There was also a standard 1N4004 rectifier diode (D207) mounted under the heatsink. I replaced this and it immediately fixed the problem! The weird part is that the diode appeared to check OK out of the circuit.

The horizontal yoke connector also had some discolouration on the plug due to heating because of a bad connection. I cleaned up the pins in the connector the the PCB header before reassembling it.

So now I have a dinky vintage 10″ Sony Trinitron SVGA display and just need to find a use for it! 🙂

HTC Desire and Belkin car charger

I noticed that my HTC Desire does not charge at full rate off my Belkin Micro USB car charger, despite it being the same rating as the original HTC wall charger (5v, 1A). It appears that the Desire obeys the somewhat recently introduced USB battery charging specification that states devices may draw up to 1.8A if the D+ and D- pins are connected by a resistance of no more than 200 Ohms.

This post shows how I modded my Belkin Micro USB car charger to charge my Desire at the full rate of almost 1A.

Getting the charger open is relatively easy; use a small flat screwdriver to pry the two halves apart. Note that the faceplate is attached to the side closest to the power LED. If the screwdriver takes too much effort you can use a vise to gently squeeze the sides along the seam to help break the seal.

Once the seal is broken the metal pin on the front will probably ping out and land somewhere awkward like under your workbench, so be prepared!

In inside looks quite tidy and simple:

Now solder a 180 Ohm resistor across pins 2 and 3 of the USB port.

To get it back together simply put a few drops of super glue along the seam. I used Selley’s Plastic Glue which is exceptionally good.

After this the battery status (Settings, About phone, Battery) shows as Charging (AC) instead of Charging (USB), indicating that the battery is now charging at full rate.

Hauppauge NOVA-S-Plus in Lucid

I’ve been using a Hauppauge NOVA-S-Plus DVB-S card for a while now with MythTV running on Ubuntu Hardy.

I recently upgraded to Lucid and had lots of difficulty getting the card to work with MythTV. All of the required kernel modules were loaded as expected (cx88xx, etc) and the device tree showed up as expected:

ls -l /dev/dvb/adapter0
total 0
crw-rw---- 1 root video 212, 1 2010-10-12 23:07 demux0
crw-rw---- 1 root video 212, 2 2010-10-12 23:07 dvr0
crw-rw---- 1 root video 212, 0 2010-10-12 23:07 frontend0
crw-rw---- 1 root video 212, 3 2010-10-12 23:07 net0

Testing dvbtune gave the following message:

dvbtune -f 1159000 -p H -s 22500000
FD 7: fd_dvr DEMUX DEVICE: : Device or resource busy

It turns out the fix is actually very simple, it’s just not very obvious or well advertised:

sudo apt-get install linux-firmware-nonfree

Apparently the firmware blobs have some legal restrictions regarding their distribution so they have been placed into a separate package as of Karmic.

Make sure you reboot after installing the firmware package.