
Apple Lightning Connector Serial Access - DaGardner
http://ramtin-amin.fr/#tristar
======
userbinator
Basic details about the ID/authentication protocol have been known for a
while: [http://www.eevblog.com/forum/oshw/oshw-apple-lightning-
conne...](http://www.eevblog.com/forum/oshw/oshw-apple-lightning-connector/)

It'd be interesting to see where this leads. I'm willing to bet that the
Chinese have RE'd most of the protocol, but have kept the secrets to
themselves. (If you're curious to learn a foreign language, and have some
interest in electronics, learn Chinese - there is a _lot_ of stuff on that
side of the Internet that can't be found in English. The whole "Gongkai"
ecosystem that bunnie writes about, for example:
[http://www.bunniestudios.com/blog/?p=4297](http://www.bunniestudios.com/blog/?p=4297))

That "BRICK_ID" signal sounds a little ominous...

------
peatmoss
Ten-years-ago me would have been shocked at the notion that cables now contain
computers. I feel like I've just barely come to terms with the idea that
computers are actually collections of computers, of which some are controlled
by their owners.

~~~
foxhill
your comment reminds me of this -

[http://spritesmods.com/?art=hddhack&page=7](http://spritesmods.com/?art=hddhack&page=7)

it makes you wonder how many Linux capable processors actually make up the
computer you run..!

------
voltagex_
Searching
[https://www.google.com.au/search?q=iBoot+for+n53,+Copyright+...](https://www.google.com.au/search?q=iBoot+for+n53,+Copyright+2007-2014,+Apple+Inc)
shows that this page could be the _only_ place that the boot messages have
been logged. Wonder if this will lead to new jailbreaks?

~~~
comex
Not directly; iBoot outputs stuff to serial, but I don't think it accepts
commands over it - or if it does, it would be the same locked-down interface
you get over USB. (I should check which one.) However, serial over the old
30-pin connector has in the past assisted jailbreak-related software by making
it easier to do low-level debugging.

~~~
Yetanfou
Well, there is this line in the output:

    
    
        Delaying boot for 0 seconds. Hit enter to break into the command prompt...
    

...which gives at least the impression of there being a command prompt. As to
how it would register a hit on that enter key remains to be seen, of course.

~~~
scintill76
I wonder if "0 seconds" means it's disabled, which would make sense for a
consumer build.

------
undrwatr
Interesting so first the device reads the lightning connector itself to
configure the pins which is a plaintext exchange? Then the mfi handshake is
done separately using a chip in the accessory? He didn't say exactly what had
to be done to activate the debug UART. Presumably once he determined the ids
for debug accessory there was no mfi handshake required or the mfi chips he
had were able to pass the handshake. Surprising that the debug functions
wouldn't be protected by a different mfi key.

------
timbuktu
Does the C in USB Type-C (USD 3.1) relate in any way to the the C in 'C10C'? I
mean soon there's going to be a lightning pin at one end and a USB Type-C at
the other end. I also guess engineers from both sides must already be talking
to each other.

~~~
techrat
No. Due to the way that Apple designed the Lightning connector, it's not
capable of higher USB specs than 2.0. Limited pins and the connector inside
the socket only contacts one side at a time.

------
foxhill
i'm always blown away when people reverse wire protocols like this - i don't
even know where i'd start to do this sort of thing..

could this be used by apps on the device in any way?

~~~
nitrogen
Start by learning about logic analyzers:
[https://en.wikipedia.org/wiki/Logic_analyzer](https://en.wikipedia.org/wiki/Logic_analyzer)

You can get cheap (but slow) analyzers as open hardware, such as the Bus
Pirate (
[https://en.wikipedia.org/wiki/Bus_Pirate](https://en.wikipedia.org/wiki/Bus_Pirate)
). Also check out the Saleae USB analyzers (
[https://www.saleae.com/](https://www.saleae.com/) ).

------
swamp40
Does anyone know the advantage of using two different pin outs on either side
of the connector, instead of simply reversing one side?

~~~
tcas
As far as I know the differential lanes are swappable. They each have an
identification channel assigned to them, so the combinations are (ACC0, Data1,
Data2) and (ACC1, Data3, Data4). Keeping in mind that the function of each
lane is found once it's plugged in the cable becomes fully reversible and
routing inside the connector is simpler.

------
thrownaway2424
Well done, impressive willingness to deal with chip-scale BGA soldering and
spend the time to reverse the wire format.

