Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

Filter by
Sorted by
Tagged with
9
votes
1answer
2k views

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
19
votes
2answers
51k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
29
votes
4answers
26k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
16
votes
1answer
23k views

How to dump flash memory with SPI?

Often flash memory is connected via SPI (Serial Peripheral Interface Bus) to a processing unit like an ARM core or a micro controller. How can one dump the memory? Can there be protection mechanisms? ...
6
votes
2answers
528 views

Which instrument is effective in discovering carrier frequency?

If two devices have wireless interconnection, how to detect carrier frequency? Range may vary in all radio, from FM, GSM to Wi-Fi and WiMax. Which tools are effective for doing this? Which one is ...
5
votes
2answers
393 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
18
votes
2answers
3k views

What techniques are used in reverse engineering a serial protocol?

I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given ...
14
votes
3answers
3k views

Where can I learn more about black-box fuzzing of small embedded systems?

Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for ...
13
votes
3answers
8k views

Are hardware dongles able to protect your software?

Various software companies distribute their software with hardware security, usually a dongle which must be mounted in order for the software to operate. I don't have experience with them, but I ...
11
votes
1answer
349 views

What kind of information can i get from reverse engineering an integrated circuit package

I've seen numerous examples of people essentially dissolving away the resin from integrated circuits in boiling high strength acid in order to expose the raw silicon chip underneath. My general ...
3
votes
1answer
366 views

How to set-up a lab for reversing a mass transit ticketing system?

I recently stumbled on a talk from Ruxcon 2012 explaining the reverse of a mass transit ticketing system. Basically, they focused on paper tickets reverse engineering with a skimmer and a lot of ...
8
votes
1answer
900 views

How was the Zero Flag implemented on Z80 ALU?

Z80 was a popular 8-bit processor with a 4-bit ALU. Implementing a zero flag for a register should be straight forward, it would be a logical NOR of all the bits on the register. Something like that ...
9
votes
3answers
452 views

Physically auditing the layout of transistors inside a processor made at 22mm process die

What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively ...
7
votes
2answers
1k views

Router's serial port only outputs garbage

I'm trying to reverse engineer a 2Wire ADSL modem/router, mainly for practice. I opened it and found a serial port (with a header conveniently already in place) but I'm not getting any useful data out ...
4
votes
1answer
237 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
2
votes
2answers
199 views

Attack on wireless interconnection [duplicate]

Scenario: Two devices have wireless connect. ( like wi-fi ) Probably encrypted. ( like wi-fi's WPA2 ) Which instruments are best for discovering carrier frequency? How encrypted-text should be ...