DCSD Cable



The DCSD Alex cable is used in factories to communicate over serial to run tests and write to the SysCfg (for serial definitions, etc) during production. These cables are produced by ShenZhen Alex Connector Co., Ltd. in China. They can be purchased from obscure markets. There are two known types of DCSD cable. An older one, with lights and only one USB female USB connector, and a newer model, which lacks lights, and has two female USB connectors.

Verbose Boot
One use of the cable is to view verbose boot. You could access this by setting debug uarts in iRecovery or nvram, however, since iOS 9, this output has been obfuscated. Note on checkm8-vulnable or prototype devices, you can set the boot args of "serial=3 debug=0x14e" in either nvram or using iBoot32Patcher/iBoot64Patcher.

Shell over serial
Using qwertyoruiopz's serialsh, it is possible to get shell over serial. This is useful, because it does not require any additional daemons other than those shipped with iOS. An example use case for this would be protecting against bootloops.

Debugging the kernel
Using the DCSD cable, it is possible to attach GDB to the iOS kernel, and pause it's running.

Writing to SysCFG
Booting Diags, it is possible to access the Diags shell, and run commands. Some of those commands can be used to write to SysCFG. Note that on A10+ devices, the "usbserial=enabled" boot argument exists, which can be used to mitigate the need for a DCSD cable.

'DCSD 3.1' PCB
This cable is made specifically for USB-C devices such as the newer models in the iPad Pro line, this cable also supports USB 3.1. USB connection from the main board splits out into a Y-style cable but turns back into one connection in the USB-A male connector.

Back of the board items of interest
There's not much on the back of the board that you couldn't technically see from the front, no ICs or anything of interest really.



Other notes

 * The Lightning Connector has a specific Accessory ID flashed to it for enabling serial via the Tristar chip.
 * This PCB is quite easy to replicate, but without the proper Accessory ID you will need to mimic the protocol similar to how key2fr did in his research.
 * In theory, you can use the Tristar for JTAG through a similar board, but JTAG gets disabled by the device during boot due to production fusing status.
 * In USB-C capable Macs Apple takes care to note the low speed USB2 pins on the TOP or BOTTOM of the connector (which are usually identical to support passive USB-C <-> USB-A cables). This suggests that these pairs may be treated differently just like how the lightning DCSD cable had a proper TOP and BOTTOM side, which would provide a second USB device on the same plug.