Zipit Z2

What is a Zipit Z2?

The Zipit Z2 Wireless Messenger was released in 2007 to be used by kids as a wifi enabled chat device. The Z2 originally came with it’s own application running on top of a Linux kernel. Soon after the device was released many people began to hack the device and get a new kernel and operating system to work on it. This page is intended to be an accumulation of information about hacking the device.

General Hardware Specifications

• Marvell PXA270 CPU @ 312mhz (overclockable)
• Marvell 802.11b/g Wifi (libertas driver)
• 32mb SDRAM
• 8mb NOR Flash Storage
• MiniSD memory card slot
• 2.8 inch QVGA color display
• 5V 2A DC Adapter Input
• Backlight QWERTY Keypad
• Headphone Jack
• Microphone and Remote control Jack (similar to Nintendo DS)
• 36 Pin Expansion (Hirose) Connector on back (see below for pinout)
• 3.7V 1230mAh Lithium Ion Battery Model ZWM2-1230LI (67mm x 60mm x 4mm)

IC / Parts List

Here is the list of chips seen on the Zipit2’s board. This list contains all the major chips, their complete markings, and available information. (source)

• NHPXA270C5 G7064572.1 0728 C312 – Marvell PXA270 cpu @ 312mhz
• 88W8686-NAP1 KKN1605.3 0703 B2P ES TW – Marvell 802.11b/g Wifi Chip
• MRVL W886 738P – assumed to be a Marvell chip that works with the 88W8686
• 7KJ41 D9HCX – two Micron MT48H8M16LFB4-8 IT 16MB SDRAM chips
• 640W18BD 5720B148 Z202125D – Intel 28F640W18 8 MB Flash (Datasheet)
• WM8750BG 76AP6HF – Wolfson Audio Chip
• ANA TI 68k A3RF – Texas Instruments BQ24035 Charging & Power Path IC (Datasheet)
• TPS 65021 TI77k – Texas Instruments Power Management IC (Datasheet)
• AER915 5650001 YuG07 32A – Suspected to be the Aeronix version of the P89LPC915
• LP53 – Texas Instruments Ultra-Low Dropout Regulator (Datasheet)
• LMS283GF05 – Samsung 320×240 LCD (Datasheet)
• 20374-R40E-31 – IPEX LCD Connector (Datasheet)
• PJ1-022-SMT-TR – DC Power Jack (Datasheet)
• Maxim DS28CM00 – Device ID ROM (I2C ID 0x50)

Expansion Connector

• Expansion connector plug (solder type for cable with housing): Hirose ST40X-36S-CV(80) (Old Part #) | Hirose ST40X-36S-CV(30) (New Part #)
• Expansion connector plug (SMT type for PCB): Hirose ST60X-36S (Old Part #) | Hirose ST60X-36S(30) (New Part #)
• Expansion connector Pinout (thanks jpb147)

Hardware Modifications

• 3.3V TTL Serial Mod
• Soft Keypad Mod
• ZipitBot
• Remote Control Pinout
• MicroSD Slot
• 16MB NOR Flash Upgrade (confirmed working)
  • M58LR128KB85ZB5E (confirmed, obsolete)
  • M58LR128KB85ZB6F
  • M58LR128KB70ZB5E

• Z2 Breakout v1 | OSH Park Project
• Z2 Breakout v2 (mini) | OSH Park Project
• Nokia BP-4L Battery Replacement
• Possible 64 or 128MB RAM Upgrade:

Linux Distributions

• Easy Flash Script / Instructions

• OpenWRT
  • openwrt-zipit (original/older) – github source | slug’s gmenu2x/jffs
  • bleeding edge (openwrt-trunk, linux 4.4) – github source | bleeding edge repo | wiki
• IZ2JFFS – IZ2S that runs from stock internal flash
• Arch Linux
• Void Linux – Originally for Sharp Zaurus (OESF Forum, voidz github, voidz packages github)

• IZ2S (Buildroot based for Stock Zipit Z2)
• EZ2S (Based on IZ2S)
• z2sid (Debian Sid)
• z2lite (Buildroot)
• z2 Recovery OS (runs from internal memory)
• z2buntu (Ubuntu Jaunty)
• Rootnexus (Debian Sid/Lenny) (Wayback Machine)
• Sidetrack (Rootnexus Remix for Security/Penetration Testing)
• WejpOS (Buildroot)
• PlugApps – (Based on Arch Linux)

Kernel

• 3.x Kernel
  • anarsoul’s github sources (v3.17-anarsoul-wip branch)
  • slug_’s github sources (v3.2-anarsoul branch)
  • slug_’s precompiled v3.2
• 4.x Kernel
  • mozzwald’s github sources (v4.4-z2 branch)
  • anarsoul’s github sources (v4.4-z2 branch)

Links

• http://linux.zipitwireless.com – Official Zipit Wiki (Wayback Machine)
• https://github.com/openwrt-zipit – OpenWrt Fork for Zipit Z2
• http://www.chainxor.org/openwrt-zipit/ – OpenWrt Zipit Info
• http://www.engine12.com – Slug’s Blog (Openwrt Zipit)
• http://macrofig.blogspot.com – Deeice’s Blog (IZ2S stuffs, misc Zipit)
• http://bealecorner.org/best/measure/z2/ – jpb147’s Zipit Info (hi-res photos, pinouts, etc)
• http://www.hostwork.com/users/matt/zipitz2 – Wicknix’s Zipit info (z2lite & z2sid)
• http://sweetlilmre.blogspot.com/search/label/zipit2 – sweetlilmre’s Blog (JTAG)
• http://www.notanon.com/ – Geordy’s Blog (misc Zipit info, hardware mods)
• http://www.russelldavis.org/ – RKDavis’ Blog (misc Zipit info, IZ2S/EZ2S)
• http://rayhaque.blogspot.com/search/label/zipit – Ray Haque’s Blog (IZ2S info)
• http://marex-hnd.blogspot.com/ – Marex’s Blog (u-boot)
• http://justinbox.aresgate.net/html/make_page.php?n=zipitbot – Nulluser’s Zipitbot
• http://zipitfan.wordpress.com/ – Fanoush’s Blog (u-boot keyboard support)
• http://uhrheber.wordpress.com/tag/zipit/ – Uhrheber’s Circuit Hell Blog (Zipit Bluetooth adapter)
• http://www.hunterdavis.com/ – Hunter Davis’s Blog (zipit, etc)
• Archive http://mendel.ugr.es/~ama/tmp/zipit/ – NeonLicht’s Zipit Page

GPIO List

Originally from here, updated by me