Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

1
vote
1answer
56 views

Is there any JTAG or UART port on the NES Classic?

Attached teardown of the NES Classic The CPU (Allwinner R16 aka A33) has 5 UART ports.
1
vote
1answer
53 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
1
vote
0answers
41 views

What is this RS-485 communication protocol/

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a samsung heat pump. Here are some hex commands I was able to sniff. Every message starts with 0x32 and ...
8
votes
1answer
104 views

SCSI interface through USB

I'm trying to dump the storage of Xiaomi Home camera. It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device. I tried mounting the SCSI disc with no ...
1
vote
0answers
38 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
0
votes
0answers
34 views

Making changes to a binary file that is a Intel hex file?

im trying to reverse the SMOK Alien firmware which can be found here. The file is a Intel HEX file. I then used srec_cat on it to create a binary file which i can actually open in an editor in order ...
0
votes
1answer
77 views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
1
vote
1answer
58 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
4
votes
0answers
35 views

Reverse engineering Nord Lead 4 control board

I am reverse engineering a synthesizer named nord lead 4. I want to tap in between the control board and mainboard which has the microprocessor. I didn't start analyzing the signals on the board ...
0
votes
0answers
25 views

Is it possible to attach hdmi sockets to a circuit board for a monitor that doesn't have them?

I have some monitors that were going to be thrown away and I thought it would be cool to turn them into live monitors for a camera or even just set them up with an HDMI port as they don't have one. I'...
0
votes
0answers
186 views

Reading unknown microcontroller

I'm trying to read and program a microcontroller's data flash, that I suppose to be a MPC5604, however, it always read everything with zeros, and very fast. The memory is not empty, so, I was ...
2
votes
1answer
90 views

I have an old Macbook A1342 that broke. Is there any way I could repurpose the LCD and give it some sort of video input?

My Macbook A1342 broke and before I throw it away I want to try and salvage the screen. I don't have much knowledge of hardware (aside from building PCs, most of my skills exist at the software level) ...
2
votes
0answers
54 views

Identifying unknown chip - markings erased

There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it. It seems that ...
0
votes
1answer
127 views

JTAG protection bypass

When protecting a device from being accessed via JTAG there are a number of ways to do it. The two that come immediately to mind are: a 'fuse' that is blown; a JTAG 'password'. What are some ...
0
votes
0answers
187 views

Snarfing firmware from a non-brand-name chip

I have a certain device, containing an ACU7515 (Actions Semiconductor) chip, which goes in pair with a flash memory chip. I was wondering if there is a general approach to dumping firmware (and ...
0
votes
0answers
28 views

What is an “FPR3 device”?

I would like to find out what an "FPR3 device" is. According to google, such a device had at some stage compromised my (managed) google account. Where do I read up on this/has anyone here heard about ...
5
votes
1answer
221 views

How to identify SWD (Serial Wire Debug) pinout?

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer. When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
0
votes
1answer
276 views

Finding JTAG/UART Connections

I need help identifying the UART or JTAG connections on this board. I would like to dump the firmware using a pirate bus.
1
vote
1answer
40 views

Assuming you know everything about a hardware platform, can you reverse the BLOB that is required for its operation? [closed]

I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does exactly?
0
votes
0answers
44 views

BLOB bootloader - pass parameters to linux kernel

I'm working with a device that uses the BLoB 2.0.5-pre2 as a boot loader. Have been able to connect to the PCB using the UART ports and using screen on linux to view the bootup process. Having an ...
3
votes
2answers
162 views

Trying to identify the JTAG/RS232 port on this board

I am doing some research into smart devices. I realized that the device is communicating with an Internet end-point but the communication is encrypted (and using a proxy tool doesn't work). I want ...
4
votes
2answers
661 views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
5
votes
0answers
240 views

Trouble finding the right Checksum algorithm

After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based. Background This is a data ...
3
votes
1answer
129 views

NFC Tag reverse engineering failed by a non-responding tag

I was curious about a system using NFC and I tried to find out what was the protocol. But after digging few days around, I have the card detected by my reader (acr122u) but that's all I get. I can't ...
-1
votes
1answer
152 views

Reverse Engineering A Tely 200 Camera

I recently got a hold of some free hardware from a company called Telylabs who had recently gone out of business. I got a Tely 200 which is an IP camera that's used for online conferences and ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
1
vote
0answers
52 views

MSP430 JTAG FUSE

I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with ...
4
votes
0answers
134 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
1
vote
0answers
50 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
5
votes
0answers
90 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
2
votes
1answer
304 views

Dump firmware from MC9S08EL32 MCU

I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me. I ...
1
vote
1answer
64 views

Dump Sequence Data from Casio electronic keyboard

I’m not quite sure whether this is the right website to post this on but... I want to try and dump sequence data from a Casio Keyboard default soundbank I believe it’s stored on a ROM chip of some ...
3
votes
0answers
504 views

Reverse engineering unknown RS232/UART binary protocol

Background story For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way. The device in question is Novametrix ...
0
votes
2answers
374 views

OBD II scanner reverse engineering

Newbie here. I'm working on an OBD II scanner and have made a hardware using STM32. It uses its inbuilt peripherals to communicate with the OBD bus (like CAN, K-Line, etc). Question: Are there any ...
8
votes
1answer
254 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
0
votes
0answers
116 views

How do copy an unknown firmware from a device to another identical device?

Can anyone help me with this? I am venturing into unknown territory, in which I have almost no experience and I hope there is an easy way to do it. I have to identical devices (sound sensors) that a ...
1
vote
1answer
454 views

Finding base address U-boot Android image from /dev/block/mmcblk0boot0

Currently I am stuck finding the base address for IDA to disassemble the boot image correctly. The img file is coming from /dev/block/mmcblk0boot0 (mcc_utils is executing: cat bootarea.img > dev/...
3
votes
1answer
279 views

How to identify unknown chip

I'm trying to play with the internals of a toy and the controller for that toy uses a chip that I have been unable to find any information on. The chip in question is this: The company is clearly ...
3
votes
2answers
803 views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
1
vote
3answers
429 views

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Here's the attached image: The CA-50 was used by Nokia to program newer phones. Nokia phones from around 2008-2011 feature this port for flashing. I noticed the USB side is unusually longer. It is ...
1
vote
1answer
650 views

How to reverse engineer hex data on EEprom? [closed]

I am learning how to reverse engineer the EEprom data in Automotive ECUs. For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things. I ...
5
votes
1answer
195 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
0
votes
1answer
146 views

reverse engineering of electronics of father.io game [closed]

Father.io game has recently become a famous AR FPS game. I want to know the concept of this game electronics design and ideas? I'm planning with some friends of me to make a shooting game like Father....
1
vote
0answers
82 views

Patch is detected yet hardware access breakpoint isn't hit

I wonder how is that possible. I found debugger detection in TLS Callback function - there is conditional jump after some check. When I step over it with debugger and modify ZF flag to bypass ...
5
votes
2answers
307 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
8
votes
2answers
2k views

reverse engineering a printer cartridge chip

Is this stack only about reverse-engineering software and firmware? What about hardware? We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you). It has ...
4
votes
1answer
351 views

What is the encoding of some old arcade chips?

So I got a couple super old chips from what looked like an arcade. The game-board they game with is OK I think. The CRT monitor is wrecked, however the chips are still good. I stuck them in my Chip ...
1
vote
0answers
239 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
8
votes
2answers
831 views

Router's serial port only outputs garbage

I'm trying to reverse engineer a 2Wire ADSL modem/router, mainly for practice. I opened it and found a serial port (with a header conveniently already in place) but I'm not getting any useful data out ...
0
votes
1answer
45 views

Why do Mobile Credit Card Devices use the TRRS connection instead of the Micro USB?

I didn't know where to ask this; I hope it's in the proper place. My wife just bought one of these mobile credit card processing devices for her phone and I was curious as to why these devices use ...