Nokia C1 LCD pinout is not documented and no datasheet is available online. But the display is extremely low cost and would be a great one for using in microcontroller projects! So here is what we do about it…
Why hack a display?
Hacking a Nokia C1-01 LCD seems like a fun project. But is it? It is much more than a casual challenge. Note that the display on this phone is a 1.8″ 160×128 true color display that is capable of showing 262k colors! It can even play true-color videos. LCD modules that do this and can be used readily with an Arduino will typically cost you thousands of bucks (INR). On the other hand, you can hack one of these LCD displays that are used in popular phones and you can purchase these LCDs as phone spare parts for a quarter of the price of an Arduino itself!
What can you possibly use the display for? You can make a small portable oscilloscope out of it or you could make an Arduino photo frame, if you are into that sort of things.
What will I use it for? I will use it to act as user interface for my IoT development boards powered by ESP8266 (which will be live on www.iot-bits.com very soon!). By using a commonly found phone display, I can make much cheaper development boards! This LCD will effectively cut down cost by ~40%
Hardware hacking workflow
No attack succeeds without a plan of action. What approach works best with hardware reverse engineering depends on the type of application. As no security is involved here, and this is only about figuring out the protocol and connections, this is relatively a very easy task.
A good approach would be as follows:
- Figure out the connections by physical inspection of connector
- Figure out connections by using a multimeter
- Guess the data interface based on pin count
- Reverse engineer the protocol using a logic analyzer
- Guess some commands and search for similar LCD controllers on internet
- Try some commands and see what they do
- Finalize results!
The electronics industry presents numerous challenges where only practical experience with electronics can actually help. One such example is with physical inspection. If you have a good knowledge of PCB design and typical routing practices in flat flex connectors (the flexible connector used on the LCD display here), then it is easy to guess many things based on physical appearance of the connector itself.
Here is the front and back view of the LCD display flat flex connector:
The image on the left is the front view and the one on the right is the view of the connector from the back side of the display.
As you can see on the connector, the upper pin is marked pin 1 and the bottom pin is pin 12 in both images. The golden part is the solder mask and the exposed metal part can be soldered on to the phone circuit (phone PCB). Also, the vias connect both front and rear metal pads – so there are just 12 pins on this LCD that need to be figure out!
On closer physical observation:
- Pin 1 and pin 12 are not connected to anything!
- Pin 4 and pin 9 are most probably ground pins (why? Notice the wider traces heading into the display. From basics of PCB design, power traces are ALWAYS wider for higher current carrying capacity)
- Pin 8 is some sort of power supply pin as well. Because it is quite thick, compared to most other traces.
- Pin 10 and pin 11 are probably LED backlight power supply (why? Because they are equal width, wide traces. Also, they are effectively the last 2 pins of the connector. And LED backlight connections are almost always the last 2 pins. You would know this by experience of working with color LCDs).
Studying the host connections
The next immediate step is to measure the voltages on the pins when the phone is actually powered on and working!
Now that we already guessed most connections – it is time to confirm the guesses. Here is how to confirm the guesses:
First point of attack is finding the LED backlight connections. Because it might be pin 10 and pin 11, the two pin voltages are checked by putting the multi-meter between those two. And it stays at 3.3V only whenever the backlight is on! The reading tells the polarity of the supply as well. So backlight pins are now confirmed.
- Pin 8 is also confirmed as power supply pin, as it always receives 3.3V from phone circuit when powered on.
- Pin 4 and pin 9 have zero resistance between them when LCD is connected to phone. Also, 3.3V can be noted w.r.t. these pins. So these must be ground pins as guessed.
- The remaining pins will have to be confirmed using a logic analyzer…
Guessing the data link
The data link with LCDs is usually one of these:
- 8-bit parallel data bus + control signals
- 16- or 18-bit parallel bus + control pins
- Serial bus
Here, the interface is obviously serial. Out of 12 pins, we already know 2 are unconnected, 2 are ground, 2 are LED backlight and 1 3.3V supply. That leaves 5 pins only!
As there must be a clock pin and at least one data pin, there must also be a reset pin (why? Because all other common color LCDs have it!). That leaves 2 mysterious pins…
Guessing the protocol
What could the communication protocol be? How is the LCD getting the image data from the phone circuit?
Again, from experience, you can know you have only 3 possibilities:
- I2C interface (400 kbps speed, uses SCL and SDA pins only)
- SPI interface (over 30 mbps speed, uses SCK, MOSI, MISO, CS pins)
- Custom interface (some special non-standard protocol)
Here, I2C is impossible – the speed is too low. The LCD cannot play videos with 400 kbps data rate!
So SPI seems highly likely, it needs 4 pins and has the type of speed expected.
Reverse engineering the protocol
Subsequent parts will cover reverse engineering of the actual communication protocol between the LCD and the phone. Observing that can reveal a lot of the commands used to put graphics on the display! It will also reveal what the remaining pins are actually used for.
Until then, happy hacking!