Phonebaby teardown

The Phonebaby backstory

In June this year, I attended Dangerous Prototypes' Hacker Camp Shenzhen (Possibly the last one too). On the intro night, Aaron from Oomlout showed a dinky little "Phonebaby" mini GSM phone he'd acquired recently.

This cute little phone ran Android 3.5 (I think) and was styled loosely after the iPhone 5 (Albeit much smaller). It even comes with an alternative back-panel The next day we toured the markets of Huaxiangbei and located the source in the "Dodgey cellphone market". So a bunch of us promptly bought one. Mine turned-out to be running Android 4-and-a-bit and I was quite surprised at how useable the phone was. It had a rear and front camera that appeared to be about the same (i.e.: bad). Here's the "rear camera" photo I immediately took (My brother, Piers):

 Here's what the front camera produces (Me and Angelo Wyszengrad gurning it up)

To my eye, I can't see much of a difference between the two. They were both taken just after I bought the thing and it's in a pretty dark corner of the market.

How's it run?

The phone worked pretty well for all the time I was in China. Downsides were that it didn't even know about any app stores (so you're stuck with what's built-in without side-loading); it had a very small amount of storage and it only has the one front-panel button (The home button - in keeping with its iPhone shtick).

I was able to get WeChat and possibly even Google Translate onto it, but when I loaded the Play Store, it would just immediately exit when I tried to start it.

Bringing it home

I took the phone home with me and the day I brought it into the office and showed my co-workers, the dang thing died. Like... totally dead!. I could get into the boot menu, but I could never start it up (the key-inputs didn't work: "volume" controlled up/down in the boot menus, but neither "Home" nor "Power" would select an item).

So now I've got a perfect excuse to dissect it and see what makes it tick!

The teardown begins!

The Phonebaby comes with a cheap screen-protecter already in place (I get the impression this is common with most phones sold in China), but this can stay as it doesn't obstruct the rest of the assembly.

The first step is to slide-up the back-panel to remove it and expose the battery-bay.

 

  

Here you can see the large ringer speaker at the top-right; The "TF" Micro-SD slot at the top-center; The rear camera top-left; The 2 SIM-card slots in the lower end of the battery bay and a large black flexible circuit on the bottom of the phone, which contains the BluetoothWiFi and GSM antennas.

Make sure the battery's not installed and remove the 4 small Philips-head screws near the corners of the case. You should use plastic spudgers/picks to lever-off the front-panel from the side-frame fairly easily. I was a bit hasty and just heaved-the sides of the frame in the battery-bay outwards till I got it separated. It wasn't too hard, but I did manage to snap-off one of the soft plastic clips in the process. Below are the frame (on the left) and the front-panel assembly (on the right).

We've exposed the vibration motor below the camera (It's connected to pads labelled "MOT"). The headphone jack used is one with a sloping cut-off at the end (But the phonebaby case is square, so this is probably just the cheapest part they had available). You can see that the ringer speaker stays with the frame and connects to the main board using spring-pins.

 Similarly the black antenna flex-circuit has four connection pads on this side that mate-up with two pairs of spring-pins on the main-board labelled BT/WIFI + GND and GSM + GND. There's a fifth GND spring-pin near the GSM one that looks like it would have grounded the frame if it were conductive.

 You can then clip the main board off the front-panel and rotate around the top-edge of the phone to lay it flat. The main board remains connected with a flex-cable to the digitiser in the front-panel. The screen is also affixed to the main board with a flex-cable that has enough slack to move it to the side to see most of whats underneath.

One thing I noticed about the front-panel/digitiser is that it's quite heavy. This appears to be partially because the digitiser is glass, but mostly because the panel its mounted to is made from cast metal (Sort-of "matchbox car" quality). This adds a bit of satisfying heft to the phone, which I don't think is unintentional. You can also see the ear-speaker also remains with the front-panel and connects to the main board with spring-pins. The front camera is exposed (and does indeed seem to have a smaller lens than the rear one). The small microphone is top-right of the main board in this picture. The screen flex-cable connects with a very fine DIL header and the digitiser has a ZIF socket (rotate the black tab upwards from the rear to release). All the other flex-connectors are soldered directly to the board. In the centre of the picture is a flex cable covered with woven-metal fabric shielding and soldered to a large set of pads. This cable connects both cameras to the main board. On the right-hand edge you can see the home button on a flex cable stuck to a shielding can. Interestingly the home-button pad has more pins than the 2 wires currently used and there's another space just below this for some kind of dimple-switch on the mainboard (The gold "target" shape), so it might be possible to add/restore the "back" or "menu" hardware buttons somewhere here.

 

 It's pretty easy to remove the LCD screen module, you just need to lever-up the connector with a spudger or screwdriver. Be careful and try alternating sides.

Flipping the phone back over to the "battery" side and removing the sticker, we can see two more shield can. I couldn't get a consistently hot gust out of my rework gun, so I resorted to brute-forcing them off (You'll notice some lifted pads in the following photos).

The fully liberated board on the "screen side". The shielding can's been removed, but I can't see much of any interest there. I presume it's either USB power management or more likely something to do with the nearby LCD connector.

Returning to the "battery side", with the cans removed, we find five "large-ish" chips.

This is a better view of the four smaller ones.

The Chips!

First up is a Mediatek MT6571A ARM SOC. I can't find any useful details about this, but Mediatek list a similar sounding MT6572 that's a dual-core 1.2GHz Arm7 with low-res screen and dual low-res camera support. So it looks like a pretty similar SOC.

 Next is the largest chip on the board: a Gigadevice CP1415. This took some hunting down (Thanks to Gus and Firnsy for the clues and info!) As with the SOC, there's no details about this particular model on the Gigadevice website, but it's most likely a flash ship of possibly 4G or more probably 2G in size.

 We found this view of it on Taobao and as you can see, it's got a pretty... bold?...  ball pattern.

This is a Mediatek MT6323GA power management chip. Again: No details on the Mediatek site, but the description was found in an AliExpress listing.

This is a Huntersun HS8292U "Mobile rf chip". It's under its own can next to the SIM cards, so is presumably separated as the start of the high-power cell-radio system.

Finally there is a Mediatek MT6627N WiFi and Bluetooth chip.

Conclusion

The Phonebaby was a remarkable capable phone, given its price and size - I'm sad it died! If I had any suggestions to the producers they would be: (1) Add hardware menu/back buttons (Almost a necessity with a screen of this size) and (2) have an option for a usable, larger main flash storage. It's very nearly a great phone on its own, even without the "mini iPhone" styling.

I'm seeing if I can put it all back together to see if the spare contacts around the menu button might be able to be used to control the boot menu. Unfortunately most everything's back in place, but I've discovered there are more pads on the main board than there are pins on the camera connector (I didn't notice this when I pulled it to bits - oopsie!). So I've either got to be careful (and try to scrutinise the photos I took to get some clues) or try just not reinstalling the camera until I've verified there's a way to recover the OS.