I have not seen any teardowns or any information of whats inside of the Virgin Media Super Hub 3 so I thought I would do it my self with one I bought from ebay for £10. As Dave at the EEVBLOG would say "don't turn it on, take it apart!".
The Super Hub 3 DOCSIS 3.0 modem/router/Ethernet switch is an Arris TG2492 and will named as such throughout.
Some basic information:
- 2.4 GHz radio and 5 GHz radio for wireless 802.11a/b/g/n/ac connectivity
- Four Ethernet ports
- Up to two lines of telephone service
- DOCSIS 3.0 and Euro-DOCSIS 3.0 compliant
The main goal of the teardown is to extract the firmware which I will do at a later date.
First of all here are some pretty pictures of the Arris TG2492.
To disassemble you first have to shim the front panel off with a thin piece of plastic or just use a flat head screw driver if you don't care about damaging it.
Remove the Torx screw which is now visible from behind the front pannel.
Flip the TG2492 around to the rear and remove the sticker which surrounds the all the ports. You will need a very sharp thin knife to do so.
Once the sticker is removed then proceed to remove the 2 Trox screws which are now visbale.
Now place the TG2492 flat so that the plastic mesh side closest to the screws is pointing upwards. Place a flat head screw driver between the case and the plastic mesh in the bottom left corner and gently pry the mesh upwards. Once the mesh is raised enough to get you fingers underneath proceed to pull the rest up by hand.
Now we have a rear view of the PCB. To remove the PCB , remove the 2 Torx circled in red at the top of the picture then push back the 2 white clips also circled in red at the bottom of the picture.
|1.||Toshiba TC58NVG0S3HTA10||128MB NAND FLASH|
|2A.||QCA9880-3R4A||Qualcomm 802.11ac wireless chipset|
|3.||Unkown||5ghz antena and exteranl Micro-Miniature RF Connector|
|1A.||Atheros AR9382-AL1A||2.4/5 GHZ, 2-STREAM 802.11A/B/G/N|
|1B.||SiGe 2620T||2.4 GHz Wireless LAN/BT Front End|
|2.||Phison PS8211-0||Nand Controller eMMC 4.5|
|3.||54328||Power management chip|
|6.||SK Hynix H5TQ2G63FFR-PBC||128MX16 DDR DRAM, PBGA96 (2048gb Ram. 4096 total)|
|7.||54328||Power management chip|
|8.||54328||Power management chip|
|9.||NBGA 650A 049||Unknown|
|10||RT8294A||2A, 23V, 340kHz Synchronous Step-Down Converter|
|11.||UART||VCC(Square pad), TX, RX, GND. 115200 8-N-1|
|12.||54226||4.5V to 18V Input 2-A Synchronous Step-Down SWIFTTM Converter|
|13A.||MXL267D||Full-Spectrum Capture (FSCTM) digital cable front-end receiver for EuroDOCSIS 3.0|
|14.||54226||4.5V to 18V Input 2-A Synchronous Step-Down SWIFTTM Converter|
|15.||Broadcom BCM53124SKMMLG||Ethernet ICs GIGABIT SWITCH|
|16.||UART||VCC(Square pad), TX, RX, GND. 115200 8-N-1|
|17.||61089B||Bourns DUAL FORWARD-CONDUCTING P-GATE THYRISTORS|
|19.||Unknown||2.5ghz antenna and external Micro-Miniature RF Connector|
|20.||Unknown||Intel Puma 6 SoC DHCE2652 (MD553005A02245, 11L602F576SR278, G29275 01 EQE)|
|21.||JTAG||10 pads covered (unknown if active). Supported by Intel System Studio with ITP-XDP3|
NAND Chip Removed (didn't survive removal, heating element needs replacing)
NAND Controller Removed
NAND controller and NAND chip overlayed
UART Intel Puma 6 DUMP 1 of 3
UART Intel Puma 6 DUMP 2 of 3
UART Intel Puma 6 DUMP 1 of 3
UART ARRIS Dump 1 of 2
UART ARRIS Dump 2 of 2