The secret of the "Debug Accessory Mode" Adapter.

The exact internals of Google's proprietary "Suzy-Q" debugging device are, at the time of this writing, unknown.

However, I have found how to make an apparently-compatible device:


We connect the USB-C "business end" into a Asus C101PA machine; the USB-B end into a reasonable Linux PC, where we then:

echo 18d1 5014 > /sys/bus/usb-serial/drivers/generic/new_id

...and /dev/ttyUSB0 ... 5 , the UARTs of the RK3399 chip, appear.

Theoretically, there are also Google-particular "vendor" endpoints. But we will look at these later.

Example spew on boot.

The unfortunate bit is that the output is, evidently, molested between leaving the RK3399 and emerging from the USB-C debug controller, by the machine's embedded controller Cr50 chip: observe, the typical reset output of Rockchip (e.g., DDR init info) is not seen in the spew.

Therefore the "debug accessory" cable can be used for kernel debugging, but not for bootloader debugging. Unless we diddle the EC controller firmware, to force it to relay UART output immediately from power-on.

Edit: Read here re: the USB endpoints.

(to be continued...)

This entry was written by Stanislav , posted on Thursday June 07 2018 , filed under Cold Air, Hardware, NonLoper, Reversing, SoftwareSucks . Bookmark the permalink . Post a comment below or leave a trackback: Trackback URL.

3 Responses to “The secret of the "Debug Accessory Mode" Adapter.”

Leave a Reply

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre lang="" line="" escaped="" highlight="">

MANDATORY: Please prove that you are human:

38 xor 67 = ?

What is the serial baud rate of the FG device ?

Answer the riddle correctly before clicking "Submit", or comment will NOT appear! Not in moderation queue, NOWHERE!