Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

Filter by
Sorted by
Tagged with
1
vote
0answers
48 views

Reverse engineering a checksum algorithm

I am attempting to implement an editor for a discontinued hardware drum synthesizer which uses undocumented system exclusive MIDI messages for communication. I've figured out the patch format, but I ...
0
votes
1answer
18 views

id the HW port and protocol

i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying. on this monitor there is external ...
0
votes
0answers
50 views

Export logic analyzer data to protocol analyzer

Probably I'm little ot but I'm unsure where to ask this. Is there any easy (already working) way to export my logic analyzer data (vcd format) to a protocol analyzer like Wireshark? I'm analyzing an ...
3
votes
1answer
93 views

What, tools do I need to break down the N64 console for private study? [closed]

Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best. So, what tools would I need To break down this console?...
2
votes
0answers
75 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
0answers
46 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
0
votes
1answer
46 views

Need to identify a diode

I need help as i'm new to reverse engineering. I need to identify a diode in a PCB that i'm currently working on. Do you guys have any idea or advise on how to identify the diode. The diode which I ...
0
votes
0answers
32 views

Can anyone please help to identify an unknown chip on auo lcd

I am trying to identify an unknown chip with these markings: 2L736 OE1940 Can anyone please help me? I have become frustrated over this.
1
vote
1answer
137 views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
0
votes
0answers
22 views

Find with IDA where an executable checks for devices plugged into computer

The executable is a firmware updater for a specific device. I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the ...
4
votes
2answers
148 views

router: how to break into boot?

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. ...
0
votes
2answers
48 views

How to wire up a rotary encoder with a “0v” connection?

I have a servo motor with rotary encoder salvaged from an old scanner. I'm trying to figure out how to re-use it in a DIY CNC machine. By reading through the engineering manual from the original ...
3
votes
2answers
56 views

Limited U-Boot options, any memory reading possibilities here?

Within this very stripped down firmware I'm looking at (hikvision camera misrepresented), this is all I have to work with. No other firmware exists, and the open-seasame command presents an encrypted ...
0
votes
0answers
37 views

Can machine learning be used to simulate the working of an actual machine?

I have seen one paper on decompiling C code and other software-based reverse engineering (of sorts) been done using machine learning (or claims on doing so). I am interested in finding out if the ...
1
vote
1answer
45 views

Dumping and reprogramming the firmware of DarenWaves

I have the following blue color lamp that can move, play music and do a few other things. I'm quite sure it has a Firmware and it's reprogrammable. I'm looking for guidance on where should I look for ...
0
votes
1answer
65 views

Is it possible to bypass the microcontroller on this massage chair without removing it?

For a research project I'm trying to create a manual control for the Chinese massage chair we've acquired, as the inbuilt controller only allows for its 5 preset programs. I am wondering what is the ...
4
votes
0answers
79 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
1
vote
0answers
27 views

Using an arduino or raspberry pi, how can I drive and control a proprietary diehen servomotor?

I’m trying to resurrect this robot from Daihen-I need to determine how this proprietary motor and encoder are wired. Anyone got experience with this?
1
vote
0answers
58 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...
3
votes
0answers
355 views

Identifying a toner chip and it's communication protocol to re-program it

I need help identifying a chip and how to reset it from a new brother toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer. There is currently no information on ...
0
votes
1answer
162 views

Glitch attack on a SPI flash eeprom

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
4
votes
0answers
77 views

How to reverse engineer an elliptical trainer? [closed]

I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...
1
vote
0answers
47 views

Motorola Freescale mpc564 microcontroller

Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
1
vote
0answers
108 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
1
vote
1answer
136 views

Is there any JTAG or UART port on the NES Classic?

Attached teardown of the NES Classic The CPU (Allwinner R16 aka A33) has 5 UART ports.
1
vote
1answer
120 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
1
vote
0answers
92 views

What is this RS-485 communication protocol/

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a samsung heat pump. Here are some hex commands I was able to sniff. Every message starts with 0x32 and ...
8
votes
1answer
237 views

SCSI interface through USB

I'm trying to dump the storage of Xiaomi Home camera. It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device. I tried mounting the SCSI disc with no ...
1
vote
0answers
97 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
1
vote
1answer
593 views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
1
vote
1answer
127 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
4
votes
0answers
50 views

Reverse engineering Nord Lead 4 control board

I am reverse engineering a synthesizer named nord lead 4. I want to tap in between the control board and mainboard which has the microprocessor. I didn't start analyzing the signals on the board ...
2
votes
1answer
114 views

I have an old Macbook A1342 that broke. Is there any way I could repurpose the LCD and give it some sort of video input?

My Macbook A1342 broke and before I throw it away I want to try and salvage the screen. I don't have much knowledge of hardware (aside from building PCs, most of my skills exist at the software level) ...
2
votes
0answers
70 views

Identifying unknown chip - markings erased

There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it. It seems that ...
0
votes
1answer
294 views

JTAG protection bypass

When protecting a device from being accessed via JTAG there are a number of ways to do it. The two that come immediately to mind are: a 'fuse' that is blown; a JTAG 'password'. What are some ...
5
votes
1answer
609 views

How to identify SWD (Serial Wire Debug) pinout?

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer. When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
0
votes
1answer
549 views

Finding JTAG/UART Connections

I need help identifying the UART or JTAG connections on this board. I would like to dump the firmware using a pirate bus.
1
vote
1answer
43 views

Assuming you know everything about a hardware platform, can you reverse the BLOB that is required for its operation? [closed]

I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does exactly?
3
votes
2answers
353 views

Trying to identify the JTAG/RS232 port on this board

I am doing some research into smart devices. I realized that the device is communicating with an Internet end-point but the communication is encrypted (and using a proxy tool doesn't work). I want ...
6
votes
2answers
2k views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
4
votes
0answers
274 views

Trouble finding the right Checksum algorithm

After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based. Background This is a data ...
3
votes
1answer
281 views

NFC Tag reverse engineering failed by a non-responding tag

I was curious about a system using NFC and I tried to find out what was the protocol. But after digging few days around, I have the card detected by my reader (acr122u) but that's all I get. I can't ...
-1
votes
1answer
159 views

Reverse Engineering A Tely 200 Camera

I recently got a hold of some free hardware from a company called Telylabs who had recently gone out of business. I got a Tely 200 which is an IP camera that's used for online conferences and ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
1
vote
0answers
88 views

MSP430 JTAG FUSE

I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with ...
4
votes
0answers
181 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
1
vote
0answers
92 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
4
votes
0answers
98 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
2
votes
1answer
431 views

Dump firmware from MC9S08EL32 MCU

I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me. I ...
1
vote
1answer
91 views

Dump Sequence Data from Casio electronic keyboard

I’m not quite sure whether this is the right website to post this on but... I want to try and dump sequence data from a Casio Keyboard default soundbank I believe it’s stored on a ROM chip of some ...