What sources do you use for gaining information/intelligence about hardware products?

Question

When reverse engineering consumer hardware products, it can often be helpful to gain as much information as possible outside of the device itself, including:

• Service manuals
• Installation/User manuals
• Circuit diagrams/block diagrams
• Description of operation
• Firmware images
• Any PC-based utilities
• Internal photographs

I have found the following sources useful:

• The manufacturer's site, including using google site search to find "hidden" documents
• Using specific google searches, e.g. limiting to PDF files and "engineers code"
• Using google searches to find open directories ("Parent directory" finds these) containing manuals and other documentation
• Using the FCC database to find test results.
• Finding any relevant patents

Are there any other useful sources for finding out such information?

Answer 1

Not applicable to every device, but always worth checking if the company used any open source software in the design and look at the code provided. Even if most of the device is proprietary, the open source code might have useful pointers towards basic hardware functionality or implementation details.

An example might be a manufacturer that has customized u-boot to function with their board and included a memory map of flash in the source.

On the google searches front, some chip manufacturers use a very predictable document number format that can be searched for, or use certain phrases that are very uncommon elsewhere, such as "proprietary and confidential" on all processor datasheets.

Finally, if a company is particularly stingy with technical details about their device, I expand my search to their business partners. For example, a processor manufacturer identified that their products were used in Company X's products in marketing materials, even when no literature directly from Company X mentioned anything about what chip or architecture they were using.

Answer 2

Personally my experience is pretty much limited to attempts to reverse engineer electronic hardware, so I'll limit my answer to that area as well. What I've found useful is

• manufacturers aren't exactly the likeliest to provide too much useful information, but it's always worth to peak into manuals or check out their websites.
• check on the web, but especially on Youtube and repair sites such as ifixit.com for instructions on how to non-destructively open a device. This usually goes already a long way in gathering additional intelligence about the device.
• assuming you have firmware-upgradeable hardware (TV, router, etc.), you should check out the firmware-mod-kit and the related binwalk to see what information you can retrieve from the firmware images.
• even if you don't have a firmware, but the device you are accessing has some kind of network connectivity, you could set up a gateway with DHCP (I prefer Linux/Ubuntu for these cases) and check the ARP cache (command arp) which will tell you the MAC address (can often be matched with the one printed on packaging or the device itself) and thereby find the IPv4 address handed out to it. From there on nmap, netcat, telnet and tcpdump/libpcap are your best friends. If it's wireless you can provide an access point that logs stuff and sniffs traffic and such.
• if your device plugs into a port such as USB and you have a protocol analyzer (expensive stuff) things can get easier. But sometimes results aren't clear or you simply have no more than an oscilloscope to investigate the protocol. Beware of bus types such as PCMCIA and Thunderbolt where the device itself has access to your computer's memory and other resources. If the device is malicious it could spy on you or do other weird stuff. Or am I just too paranoid? After all you said consumer hardware :)
  • on that note, a "simple USB mouse" could also pose as USB keyboard to the computer and perhaps USB storage and the keyboard would do fancy things like enter commands and execute stuff from the storage. So never ever plug a USB key you find into one of your devices unless you have a special test machine for the purpose.
• older hardware often comes with actual layouts for the PCBs etc, but rarely with an actual bill of materials. Still, it gives you some further clues. Older TV sets and those from reputable manufacturers tend to come with very detailed diagrams of their electronics where I come from.
• once you manage to open it up the first thing you'll need in most cases is a magnifying glass ;)
  • having that you can figure out whether there is a serial UART or JTAG (contacts labeled TDI, TDO, TCK, TMS, TRST are easy to spot) or other kind of "breakout" possibility. JTAG isn't too useful if you don't know enough about the hardware to safely use boundary scan (voltage etc, you could actually fry your hardware before you get to see results).
  • labels on the chips/processors usually help a lot and then checking over at your local hobbyist website for tinkering with electronic devices.

That's it from me. My two cents. I'm sure there are a whole lot of things that I haven't considered in my own searches, so I'm looking forward to other answers.

---

Yes, using search operators can work to your advantage, such as inurl, intitle, filetype and site on Google (e.g. search terms intitle:index inurl:ftp). Unfortunately there doesn't seem to be a standard for search operators and especially meta search engines are very weak on that front, but also Google's competitors, which is sad. There is also one caveat with search operators on Google. You can read about it in this question over on webapps.SE.