Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Extracting a firmware image via U-Boot and mounting/expanding it

I'm attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the ...
0
votes
0answers
66 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
0
votes
1answer
79 views

Reverse UART communication protocol

I'm objective is to build a custom wifi module to be used on a Samsung AC AR24HSFSAWKN. I have such an official module SWL-B70F for which I'm trying to reverse engineer the communication with the main ...
0
votes
0answers
23 views

infrared remote codes yamaha RXV-596 / RAV211

My remote (one of ...) is not working anymore. I've search in differents databases, but the model is too old and I've not success to get the IR codes. If someone has this old Yamaha receiver*, with a ...
0
votes
0answers
65 views

Reverse Engineering a CPU

So, I got inspired through a friend, how single-handedly reverse engineered a little cpu(nvidia falcon) and I was wondering if there any other cpu's like this one, because I want to do this myself but ...
0
votes
0answers
34 views

Trying to edit the source code of AOC monitor

So long story short the AOC monitor comes with a G-Menu gui that lets you customize different monitor features. One specific one I am interested in is the "Dial Point" setting. Where it ...
2
votes
0answers
69 views

What are these pads called, what can I solder to them and could I do any damage?

I am wondering what this is called (those are 1 and 2 cm marks, divided into 1 mm segments): I'm fairly certain it's not JST. I think the two larger pads are used to hold whatever connector is ...
1
vote
0answers
21 views

Looking at a PCB is it possible to ascertain the number of layers it has?

Is there a way to ascertain - without special equipment (other than what a "layman electronics enthusiast" may have around) - how many layers a PCB has? Is there some sort of marking or a ...
0
votes
0answers
30 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
2
votes
1answer
73 views

crc - reverse engineering GAL16V8 checksum method

While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL has a checksum byte I've read the PES of some GALs but was ...
1
vote
1answer
62 views

I have a two pin debug interface, confused on how to use it

I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
1
vote
1answer
30 views

Wrong keyboard strokes sent to serial in putty

I am attempting to communicate to a device i have via the onboard rx/tx solder points i found on the board. I am doing this via an arduino uno. The problem i am having is that when i connect to it ...
3
votes
1answer
108 views

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
0
votes
1answer
58 views

Can a UART port change baud rate at runtime?

I've been probing this CCTV DVR board trying to find a serial port to see if I can get console access to it. I found a set of 4 through holes with no headers that looked like a good candidate. I ...
1
vote
1answer
44 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
0
votes
0answers
57 views

How does this levitating clock work?

I came across the Flyte STORY clock recently (link) and I’m stumped as to how it works. Does anyone know how it holds the ball against gravity when it’s vertically upright? I asked Physics but they ...
0
votes
1answer
65 views

Misterious USB dongle

I have this USB stick that seems to have a slot for a SIM and for a SD card. I don't know nothing else about this module. Searching the codes on internet I didn't find anything. How could I find ...
0
votes
1answer
150 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
1answer
70 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
0
votes
0answers
31 views

Make operational an old FTDI USB hardware on new OS

I have an old hardware that is controlled by a software for which I don't have the source code and the company that made it has closed their business. The original software is really slow (it use ...
0
votes
0answers
215 views

Samsung A520F usb type-c uart debug mode

I'm trying to create UART cable for A520F phone with USB type-c. Seems, there is no UART debug modes S8+ either. On Samsung phones with micro USB one may access UART JIG mode with 619K resistor, ...
0
votes
1answer
48 views

Manufacturer interface on OCZ Agility 4 SSD

Inside the housing of an OCZ Agility 4 SSD I found several additional connectors on the opposite site of the SATA connectors. What are they good for and how to connect them properly? Zoomed:
1
vote
1answer
92 views

If flashrom tool don't have support for rom chip what are the ways you can extract data without it?

I am currently working on a Netgear router having MX25L1606E rom chip, my goal is to extract firmware for reverse engineering but flashrom don't have support for it. So question is how someone can ...
2
votes
0answers
58 views

Voltage Glitching to Read Internal EEPROM

I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it. I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it'...
2
votes
1answer
312 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
2
votes
0answers
1k views

Hacking old gym equipment

Anyone reversed ifit? I just picked up a discounted NordicTrack Elite 11.0 Elliptical on Ebay, I want to hack it. I would like to extract performance data and it would be great if I could control ...
4
votes
0answers
208 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
1
vote
0answers
250 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
2
votes
0answers
44 views

Is there a way to identify a specific microprocessor model?

I'm working on reversing a USB flash drive controller chip. I know there's a microprocessor that runs some 8051 variant, and I have the ability to run arbitrary code on it. There's lots of different ...
2
votes
2answers
319 views

Reverse engineering a checksum algorithm

I am attempting to implement an editor for a discontinued hardware drum synthesizer which uses undocumented system exclusive MIDI messages for communication. I've figured out the patch format, but I ...
1
vote
1answer
33 views

id the HW port and protocol

i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying. on this monitor there is external ...
0
votes
0answers
102 views

Export logic analyzer data to protocol analyzer

Probably I'm little ot but I'm unsure where to ask this. Is there any easy (already working) way to export my logic analyzer data (vcd format) to a protocol analyzer like Wireshark? I'm analyzing an ...
3
votes
1answer
131 views

What, tools do I need to break down the N64 console for private study? [closed]

Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best. So, what tools would I need To break down this console?...
2
votes
0answers
135 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
1answer
244 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
0
votes
1answer
89 views

Need to identify a diode

I need help as i'm new to reverse engineering. I need to identify a diode in a PCB that i'm currently working on. Do you guys have any idea or advise on how to identify the diode. The diode which I ...
1
vote
1answer
524 views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
4
votes
2answers
480 views

router: how to break into boot?

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. ...
0
votes
2answers
157 views

How to wire up a rotary encoder with a “0v” connection?

I have a servo motor with rotary encoder salvaged from an old scanner. I'm trying to figure out how to re-use it in a DIY CNC machine. By reading through the engineering manual from the original ...
3
votes
2answers
184 views

Limited U-Boot options, any memory reading possibilities here?

Within this very stripped down firmware I'm looking at (hikvision camera misrepresented), this is all I have to work with. No other firmware exists, and the open-seasame command presents an encrypted ...
1
vote
1answer
70 views

Dumping and reprogramming the firmware of DarenWaves

I have the following blue color lamp that can move, play music and do a few other things. I'm quite sure it has a Firmware and it's reprogrammable. I'm looking for guidance on where should I look for ...
0
votes
1answer
75 views

Is it possible to bypass the microcontroller on this massage chair without removing it?

For a research project I'm trying to create a manual control for the Chinese massage chair we've acquired, as the inbuilt controller only allows for its 5 preset programs. I am wondering what is the ...
4
votes
0answers
98 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
1
vote
0answers
31 views

Using an arduino or raspberry pi, how can I drive and control a proprietary diehen servomotor?

I’m trying to resurrect this robot from Daihen-I need to determine how this proprietary motor and encoder are wired. Anyone got experience with this?
1
vote
0answers
75 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...
6
votes
1answer
915 views

Identifying a toner chip and it's communication protocol to re-program it

I need help identifying a chip and how to reset it from a new brother toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer. There is currently no information on ...
0
votes
1answer
280 views

Glitch attack on a SPI flash eeprom

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
4
votes
0answers
150 views

How to reverse engineer an elliptical trainer? [closed]

I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...
1
vote
0answers
73 views

Motorola Freescale mpc564 microcontroller

Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
1
vote
0answers
155 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...