Zipit Z2

What is a Zipit Z2?

The Zipit Z2 Wireless Messenger was released in 2007 to be used by kids as a wifi enabled chat device. The Z2 originally came with it’s own application running on top of a Linux kernel. Soon after the device was released many people began to hack the device and get a new kernel and operating system to work on it. This page is intended to be an accumulation of information about hacking the device.

General Hardware Specifications

  • Marvell PXA270 CPU @ 312mhz (overclockable)
  • Marvell 802.11b/g Wifi (libertas driver)
  • 32mb SDRAM
  • 8mb NOR Flash Storage
  • MiniSD memory card slot
  • 2.8 inch QVGA color display
  • 5V 2A DC Adapter Input
  • Backlight QWERTY Keypad
  • Headphone Jack
  • Microphone and Remote control Jack (similar to Nintendo DS)
  • 36 Pin Expansion (Hirose) Connector on back (see below for pinout)
  • 3.7V 1230mAh Lithium Ion Battery Model ZWM2-1230LI (67mm x 60mm x 4mm)

IC / Parts List

Here is the list of chips seen on the Zipit2’s board. This list contains all the major chips, their complete markings, and available information. (source)

  • NHPXA270C5 G7064572.1 0728 C312 - Marvell PXA270 cpu @ 312mhz (Developers Manual, Datasheet)
  • 88W8686-NAP1 KKN1605.3 0703 B2P ES TW - Marvell 802.11b/g Wifi Chip
  • MRVL W886 738P - assumed to be a Marvell chip that works with the 88W8686
  • 7KJ41 D9HCX - two Micron MT48H8M16LFB4-8 IT 16MB SDRAM chips (Datasheet)
  • 640W18BD 5720B148 Z202125D - Intel 28F640W18 8 MB Flash (Datasheet)
  • WM8750BG 76AP6HF - Wolfson Audio Chip (Datasheet)
  • ANA TI 68k A3RF - Texas Instruments BQ24035 Charging & Power Path IC (Datasheet)
  • TPS 65021 TI77k - Texas Instruments Power Management IC (Datasheet)
  • AER915 5650001 YuG07 32A - Suspected to be the Aeronix version of the P89LPC915 (Datasheet)
  • LP53 - Texas Instruments Ultra-Low Dropout Regulator (Datasheet)
  • LMS283GF05 - Samsung 320×240 LCD (Datasheet)
  • 20374-R40E-31 - IPEX LCD Connector (Datasheet)
  • PJ1-022-SMT-TR - DC Power Jack (Datasheet)
  • Maxim DS28CM00 - Device ID ROM (I2C ID 0x50) Datasheet


Z2 Mainboard with parts removed (by jpb147)

Expansion Connector

USB Wiring

Hardware Modifications

Linux Distributions

Active Distros:

Inactive Distros:

  • IZ2S (Buildroot based for Stock Zipit Z2)
  • EZ2S (Based on IZ2S)
  • z2sid (Debian Sid)
  • z2lite (Buildroot)
  • z2 Recovery OS (runs from internal memory)
  • z2buntu (Ubuntu Jaunty)
  • Rootnexus (Debian Sid/Lenny)
  • Sidetrack (Rootnexus Remix for Security/Penetration Testing)
  • WejpOS (Buildroot)
  • PlugApps - (Based on Arch Linux)

Kernel

Links

GPIO List

Originally from here, updated by me

 
GPIO Direction Function Name Note
0 in 0   (A/C power detect, present = 1) verified
1 in 0   (reads 0 while power button pressed) verified
2 in 0    
3 in 1    
4 in 1    
5 in 0    
6 in 0    
7 in 0    
8 in 0    
9 out 0    
10 out 0   (right-hand LED, on = 0) verified
11 out 2 PWM_OUT<2> LCD Backlight
12 in 2 CIF_DD<7> Expansion Connector Pin 30 (PWM Capable)
13 out 0    
14 out 0   Wifi Power Toggle
15 out 0   wifi power ?
16 in 1 KP_MKIN<5> Keypad
17 in 1 KP_MKIN<6> Keypad
18 out 0    
19 out 0   LCD Reset
20 out 0    
21 out 0    
22 out 0    
23 out 2 SSPSCLK verified
24 out 0   Wifi Chip Select
25 out 2 SSPTXD verified
26 in 1 SSPRXD verified
27 out 0    
28 out 1 I2S_BITCLK  
29 in 1 AC97_SDATA_IN_0 (probably a bug, configured as I2S_SDATA_IN by blob) looks like the z2app uses it as an ac97 codec
30 out 1 I2S_SDATA_OUT  
31 out 1 I2S_SYNC  
32 out 2 MMCLK  
33 out 0    
34 in 2 KP_MKIN<3> Keypad
35 out 2 KP_MKOUT<6> Keypad
36 in 0 IRQ Wifi IRQ
37 out 0   (headphone detect, present = 0)
38 in 2 KP_MKIN<4> Keypad
39 out 0    
40 in 0    
41 out 1 KP_MKOUT<7> Keypad
42 in 1 BTRXD Expansion Connector Pin 7 (Breakout Board Dock Detection)
43 out 2 BTTXD  
44 in 3 CIF_FV Expansion Connector Pin 36 (breakout board relay control)
45 out 0 CIF_PCLK / SSPSYSCLK3 Expansion Connector Pin 31
46 in 2 STD_RXD  
47 out 1 STD_TXD  
48 out 0    
49 out 0    
50 in 1 CIF_DD<3> Expansion Connector Pin 26
51 in 1 CIF_DD<2> Expansion Connector Pin 25
52 in 1 CIF_DD<4> Expansion Connector Pin 27
53 out 2 CIF_MCLK Expansion Connector Pin 21
54 in 3 CIF_PCLK Expansion Connector Pin 20 (breakout board 5V Regulator enable)
55 in 0   (app reads)
56 in 0   (app reads)
57 in 0   (app reads)
58 out 0 LDD<0> LCD
59 out 0 LDD<1> LCD
60 out 0 LDD<2> LCD
61 out 0 LDD<3> LCD
62 out 0 LDD<4> LCD
63 out 0 LDD<5> LCD
64 out 2 LDD<6> LCD
65 out 2 LDD<7> LCD
66 out 2 LDD<8> LCD
67 out 2 LDD<9> LCD
68 out 2 LDD<10> LCD
69 out 2 LDD<11> LCD
70 out 2 LDD<12> LCD
71 out 2 LDD<13> LCD
72 out 2 LDD<14> LCD
73 out 2 LDD<15> LCD
74 out 2 L_FCLK_RD LCD
75 out 2 L_LCLK_A0 LCD
76 out 2 L_PCLK_WR LCD
77 out 2 L_BIAS LCD
78 out 0    
79 out 0    
80 out 0    
81 in 2 CIF_DD<0> Expansion Connector Pin 23
82 in 0   (app reads)
83 out 0   Charging Amber LED 0 = enable (confirmed)
84 in 3 CIF_FV Expansion Connector Pin 35 (breakout board relay control)
85 out 0   (battery charge enable? 1 = inhibit, 0 = enable (according to battery LED))
86 out 0   Expansion Connector Pin 32 (breakout board relay control)
87 out 0    
88 out 0   LCD Chip Select
89 out 0    
90 out 0    
91 out 0    
92 in 1 MMDAT<0> (bidirectional)
93 in 2 CIF_DD<6> Expansion Connector Pin 29
94 in 2 CIF_DD<5> Expansion Connector Pin 28
95 in 0   bq24035 Charging IC STATUS 2 Input, verified
96 in 0   (MMC card detect - both edges active)
97 out 0    
98 in 0   clamshell / lid detect, open = 1, closed = 0
99 in 0   bq24035 Charging IC STATUS 1 Input, verified
100 in 1 KP_MKIN<0> Keypad
101 in  1 KP_MKIN<1> Keypad
102 in 1 KP_MKIN<2> Keypad
103 out 2 KP_MKOUT<0> Keypad
104 out 2 KP_MKOUT<1> Keypad
105 out 2 KP_MKOUT<2> Keypad
106 out 2 KP_MKOUT<3> Keypad
107 out 2 KP_MKOUT<4> Keypad
108 out 2 KP_MKOUT<5> Keypad
109 out 1 MMDAT<1>  
110 out 1 MMDAT<2>/MMCS<0>  
111 out 1 MMDAT<3>/MMCS<1>  
112 out 1 MMCMD  
113 out 1 I2S_SYSCLK  
114 in 1 CIF_DD<1> Expansion Connector Pin 24
115 out 3 PWM_OUT<1> Keypad Backlight
116 out 0    
117 in 0   (bit-bang I2C/SCL, mode 1 = low, 0 = high/input)
118 in 0   (bit-bang I2C/SDA, mode 1 = low, 0 = high/input)
119 in 0    
120 in 0