Gigaset C430 Hacking » History » Revision 2

« Previous | Revision 2/10 (diff) | Next »
manawyrm, 11/21/2022 02:39 PM

Gigaset C430 Hacking


The C430HX/A phones use a Dialog/Renesas SC14441 SoC, which is a fully integrated DECT handset IC, with all peripherals built in.
The firmware is stored on an external Quad-SPI flash chip (MX25U1635E), 2 MByte.

The CPU inside the SC14441 is a CompactRISC CR16c plus-architecture.


The firmware can be modded by unsoldering the SPI flash chip and flashing it in an external programmer (like a MiniPro TL866):


Be careful when trying to flash the SPI flash in-circuit! The phone runs at 1.8V I/O voltage! Do not apply 3.3V to any parts of the system externally!

The SPI flash IC is being accessed at 82.944MHz, using Quad-SPI.
Trying to run jumper wires from the SOIC footprint out to an external socket can be accomplished, but needs to be done very carefully, ideally with shielded wires, kept as short as possible. Even with a pretty reasonable setup, the phone will be unstable in this configuration.
It might be possible to lower the SPI clock frequency to a more reasonable value somehow.


Not much info is available about the SC14441 (except for a single page overview), but a datasheet for the similar SC14480 SoC is floating around online.
The SC14480 has many of the same registers and peripherals and the register maps are highly useful for looking at the SC14441/C430 firmware.

Gigaset also offers a GPL download .tar.gz for another product from their DECT lineup for one of their DECT base stations, which is running GPL software.
This tarball contains a full GNU toolchain and a bunch of other interesting things:

Ghidra can decompile the firmware image for the phones with the cr16c architecture.
You'll need to map the flash memory at 0xF0000 and some volatile peripheral registers at 0xFF4000 - 0xFFC00.



Custom ringtones

Ni-MH battery charge configuration

Files (7)
IMG_2138.JPG View IMG_2138.JPG 759 KB Gigaset C430HX internal PCB manawyrm, 11/21/2022 02:12 PM
IMG_6053.JPG View IMG_6053.JPG 1.85 MB MiniPro TL866 programmer, with ZIF socket manawyrm, 11/21/2022 02:12 PM
xocetzhvijs.png View xocetzhvijs.png 16.8 KB Ghidra memory map setup manawyrm, 11/21/2022 02:38 PM
cgpmjvoeitb.jpg View cgpmjvoeitb.jpg 398 KB C430, showing the custom "nyan" ringtone manawyrm, 11/21/2022 03:10 PM
wqdiyzjfpvk.png View wqdiyzjfpvk.png 9.56 KB Hex editor, showing the string literals for all ringtones manawyrm, 11/21/2022 03:12 PM
hgtedmkcrfq.jpg View hgtedmkcrfq.jpg 2.95 MB battery voltage and current, stock firmware manawyrm, 11/22/2022 01:38 AM
dwbaefchmtk.jpg View dwbaefchmtk.jpg 2.81 MB battery voltage and current, modded firmware manawyrm, 11/22/2022 01:38 AM

Updated by manawyrm over 1 year ago · 2 revisions

Add picture from clipboard (Maximum size: 48.8 MB)