4 ms·

Restoring an Apple Silicon Developer Transition Kit "DTK" Mac Mini [video]

96 points by theogravity 2y ago

shortformblog 2y ago
dosdude1 is perhaps the most interesting hardware hacker out there today. The willingness to do something as wild as he does here—literally using a file on the board to fix an otherwise device-breaking crack—is incredible. Happy he gets to experiment with this machine.
- SpecialistK 2y ago
  Not to mention how useful his software tools are as well! The MacOS patchers (and now work on OpenCore (Legacy)) have saved thousands of machines from an early retirement.
- sitzkrieg 2y ago
  if you want to see this on a daily basis checkout "electronics repair school" on yt, silly name but extremely skilled repairs. this guy does stuff that used to take me 4+ hr a 30min yt while drinking coffee and narrating
shepherdjerred 2y ago
I didn't expect to watch that entire video, but it was so interesting. Part of me is jealous of how much knowledge and skill the author has.
- nxobject 2y ago
  Especially what it takes to reprogram and re-pair NANDs and Macs together. It's absurd that NANDs not only encode board SN, but MAC ID as well.
  - oneplane 2y ago
    It is pretty interesting how this has evolved over the decades. Most hardware has some sort of one-way identity that can be stored in a ROM or sometimes just on the mainboard (like adding/removing some zero-ohm resistors). But because the information has gotten so much more involved over time we now have specific areas on almost all hardware that store device-specific calibration data but also code for network cards to be able to function at all (pretty much all Intel PCs have a GbE firmware embedded in the BIOS or UEFI ROM for example). There used to be separate chips for everything as well, but that became too error-prone and limiting, so instead of having 10 ROMs of varying kinds we ended up with 3 in most cases (embedded boot ROM, device ROM and storage ROM), which then got slimmed down even more to the point where there is a SiP or SoC ROM and either NAND or DFU has to do everything else. Depending on the vendor, some have been adding some 'extra' ROMs (usually Flash EEPROMs) for embedded controllers because they can't trust or modify the hardware delivered by their partners (AMD/Intel) as much as they like, so they do it externally (HP SureStart for example). But because those controllers themselves also have a boot ROM and an embedded config ROM you now end up adding 3 ROMs back into the completed product. We even had a short period where the Intel ME in the chipset had one as well, so you ended up with at least 5 boot ROMs (CPU, CH, GbE, USB, EC) and 2 separate combined ROMs (one of which was the combined traditional BIOS ROM, the other purely the EC), just to start up a random desktop PC.
    - 1oooqooq 2y ago
      it's almost like the purple shipping binary blobs dislike being inconvenienced by other people's binary blobs while they ship their binary blobs. shocking.
  - rootsudo 2y ago
    What was most interesting is that WI-FI is binded to the Mac Serial Number, meaning that the mac address even though it is able to be manipulated in OSX, gives out so much information about who you are and allows very easy: Mac Address (the wifi serial hw serial number) > Mac Serial address > who you are. It's interesting.
    - sitzkrieg 2y ago
      nation states love this one weird trick
    - Hamuko 2y ago
      Doesn't the operating system use a randomised MAC address when connecting to Wi-Fi though?
      - 1oooqooq 2y ago
        for the AP, yes. apple don't want google nest knowing who you are. but the real mac is used in lots more places. even for "random" uuid generation.
Wowfunhappy 2y ago
Can anyone explain to a hardware idiot how he fixed the short (where Apple cut the board)? I don't understand why scraping off layers like that made it go away. Why can the board still work after you've taken out a chunk of it (as long as you take out enough chunks)?
- RodgerTheGreat 2y ago
  The damage to the board was caused by a tool like a pair of tinsnips, crushing the layers of the board together while cutting. The tiny layers of copper are folded together at the edge of the cut, causing shorts. By sanding away the board at a much shallower angle than the original cut it is possible to expose an edge along which no conductive layers are bridged. As for how the board still works when that area is cut out, probably just a degree of luck that none of the traces that were severed were essential?
  - Wowfunhappy 2y ago
    Ah, thank you! So it wasn't actually the cut that "broke" it, it was the fact it was crushed.
  - simondotau 2y ago
    Based on appearances, the board has a tight cluster of components laid out similarly to a contemporaneous iPad. The rest of it seems like a vast empty wasteland, lightly populated with debug terminals, ports, and compatibility shims which make it work inside a Mac mini chassis. Chances are the breakage caused a power rail to short and the “repair” fixed the short while leaving one or two debug points inoperable.
- runjake 2y ago
  I believe Wowfunhappy is referring to this section of the video: https://www.youtube.com/watch?v=reQq8fx4D0Q&t=422s https://www.youtube.com/watch?v=reQq8fx4D0Q&t=422s
- jwagenet 2y ago
  When you clip the board, the conductive layers are also being smooshed together and touch despite the non-conductive layers, which seems to persist during the enlargement of the cut. I imagine the goal of the flat filing is to remove more material from the top layers an “terrace” the layer lines until they don’t touch. As far as the repair is concerned, it seems like the cut only goes through continuous ground or voltage planes. So in a sense, it is lucky no important traces or logic lines are harmed in the process.
Lammy 2y ago
A lot of people got XBOX360 XDK boards in this same way back in The Day.

96 points by theogravity 2y ago

dosdude1 is perhaps the most interesting hardware hacker out there today. The willingness to do something as wild as he does here—literally using a file on the board to fix an otherwise device-breaking crack—is incredible. Happy he gets to experiment with this machine.

SpecialistK 2y ago
Not to mention how useful his software tools are as well! The MacOS patchers (and now work on OpenCore (Legacy)) have saved thousands of machines from an early retirement.
sitzkrieg 2y ago
if you want to see this on a daily basis checkout "electronics repair school" on yt, silly name but extremely skilled repairs. this guy does stuff that used to take me 4+ hr a 30min yt while drinking coffee and narrating

shepherdjerred 2y ago

I didn't expect to watch that entire video, but it was so interesting. Part of me is jealous of how much knowledge and skill the author has.

nxobject 2y ago
Especially what it takes to reprogram and re-pair NANDs and Macs together. It's absurd that NANDs not only encode board SN, but MAC ID as well.
- oneplane 2y ago
  It is pretty interesting how this has evolved over the decades. Most hardware has some sort of one-way identity that can be stored in a ROM or sometimes just on the mainboard (like adding/removing some zero-ohm resistors). But because the information has gotten so much more involved over time we now have specific areas on almost all hardware that store device-specific calibration data but also code for network cards to be able to function at all (pretty much all Intel PCs have a GbE firmware embedded in the BIOS or UEFI ROM for example). There used to be separate chips for everything as well, but that became too error-prone and limiting, so instead of having 10 ROMs of varying kinds we ended up with 3 in most cases (embedded boot ROM, device ROM and storage ROM), which then got slimmed down even more to the point where there is a SiP or SoC ROM and either NAND or DFU has to do everything else. Depending on the vendor, some have been adding some 'extra' ROMs (usually Flash EEPROMs) for embedded controllers because they can't trust or modify the hardware delivered by their partners (AMD/Intel) as much as they like, so they do it externally (HP SureStart for example). But because those controllers themselves also have a boot ROM and an embedded config ROM you now end up adding 3 ROMs back into the completed product. We even had a short period where the Intel ME in the chipset had one as well, so you ended up with at least 5 boot ROMs (CPU, CH, GbE, USB, EC) and 2 separate combined ROMs (one of which was the combined traditional BIOS ROM, the other purely the EC), just to start up a random desktop PC.
  - 1oooqooq 2y ago
    it's almost like the purple shipping binary blobs dislike being inconvenienced by other people's binary blobs while they ship their binary blobs. shocking.
- rootsudo 2y ago
  What was most interesting is that WI-FI is binded to the Mac Serial Number, meaning that the mac address even though it is able to be manipulated in OSX, gives out so much information about who you are and allows very easy: Mac Address (the wifi serial hw serial number) > Mac Serial address > who you are. It's interesting.
  - sitzkrieg 2y ago
    nation states love this one weird trick
  - Hamuko 2y ago
    Doesn't the operating system use a randomised MAC address when connecting to Wi-Fi though?
    - 1oooqooq 2y ago
      for the AP, yes. apple don't want google nest knowing who you are. but the real mac is used in lots more places. even for "random" uuid generation.

Wowfunhappy 2y ago

Can anyone explain to a hardware idiot how he fixed the short (where Apple cut the board)? I don't understand why scraping off layers like that made it go away. Why can the board still work after you've taken out a chunk of it (as long as you take out enough chunks)?

RodgerTheGreat 2y ago
The damage to the board was caused by a tool like a pair of tinsnips, crushing the layers of the board together while cutting. The tiny layers of copper are folded together at the edge of the cut, causing shorts. By sanding away the board at a much shallower angle than the original cut it is possible to expose an edge along which no conductive layers are bridged. As for how the board still works when that area is cut out, probably just a degree of luck that none of the traces that were severed were essential?
- Wowfunhappy 2y ago
  Ah, thank you! So it wasn't actually the cut that "broke" it, it was the fact it was crushed.
- simondotau 2y ago
  Based on appearances, the board has a tight cluster of components laid out similarly to a contemporaneous iPad. The rest of it seems like a vast empty wasteland, lightly populated with debug terminals, ports, and compatibility shims which make it work inside a Mac mini chassis. Chances are the breakage caused a power rail to short and the “repair” fixed the short while leaving one or two debug points inoperable.
runjake 2y ago
I believe Wowfunhappy is referring to this section of the video: https://www.youtube.com/watch?v=reQq8fx4D0Q&t=422s https://www.youtube.com/watch?v=reQq8fx4D0Q&t=422s
jwagenet 2y ago
When you clip the board, the conductive layers are also being smooshed together and touch despite the non-conductive layers, which seems to persist during the enlargement of the cut. I imagine the goal of the flat filing is to remove more material from the top layers an “terrace” the layer lines until they don’t touch. As far as the repair is concerned, it seems like the cut only goes through continuous ground or voltage planes. So in a sense, it is lucky no important traces or logic lines are harmed in the process.

Lammy 2y ago

A lot of people got XBOX360 XDK boards in this same way back in The Day.