Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

Filter by
Sorted by
Tagged with
50
votes
5answers
26k views

Bypassing copy protection in microcontrollers using glitching

The ATmega microcontrollers generally have two lock bits, LB1 and LB2. One prevents further programming, and the other prevents the flash being read back. If both are set, the chip needs to be erased ...
33
votes
7answers
30k views

Reverse engineering T-Disk barcodes for Tassimo coffee makers

In hope this is appropriate I have a Bosch Tassimo TAS2002EE coffee maker that uses T-Disks. Those contain coffee/milk/something else, and a barcode that is supposed to tell the machine how to deal ...
28
votes
4answers
26k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
24
votes
3answers
7k views

Reversing an FPGA circuit

Let's assume I have a device with an FPGA on it, and I managed to extract the bitstream from its flash. How would I go about recovering its behavior? One simple case is if it implements a soft ...
22
votes
4answers
3k views

Knowledge about CPU hardware

Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc... Up until now I have been treating the CPU as a black box that runs assembly ...
19
votes
2answers
51k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
18
votes
2answers
3k views

What techniques are used in reverse engineering a serial protocol?

I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given ...
16
votes
1answer
23k views

How to dump flash memory with SPI?

Often flash memory is connected via SPI (Serial Peripheral Interface Bus) to a processing unit like an ARM core or a micro controller. How can one dump the memory? Can there be protection mechanisms? ...
15
votes
2answers
1k views

Determining the serial port protocol of a typewriter

How can i determine the serial protocol of a electric typewriter? some electric typewriters have a serial port in the back and it is a shape that is not commonly used today. I am planing on ...
14
votes
3answers
3k views

Where can I learn more about black-box fuzzing of small embedded systems?

Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for ...
13
votes
3answers
8k views

Are hardware dongles able to protect your software?

Various software companies distribute their software with hardware security, usually a dongle which must be mounted in order for the software to operate. I don't have experience with them, but I ...
13
votes
4answers
11k views

E Ink display interface protocol

I am particularly interested in the ED060XC3 that is in the kindle paperwhite (I think that is the right one anyway). I can't find a freely available datasheet. Would it be possible to reverse ...
13
votes
3answers
28k views

Extracting a firmware image via U-Boot

I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC. I'm trying to get access to the device. It has a hardware serial port, and I've gotten ...
11
votes
4answers
3k views

Identifying an unknown chip on a PCB

I'm working on reverse engineering a PCB (no documentation by manufacturer). I've identified all the other chips on this board but this one refuses to give up any google-able info. Are there any ...
11
votes
1answer
349 views

What kind of information can i get from reverse engineering an integrated circuit package

I've seen numerous examples of people essentially dissolving away the resin from integrated circuits in boiling high strength acid in order to expose the raw silicon chip underneath. My general ...
11
votes
2answers
617 views

What sources do you use for gaining information/intelligence about hardware products?

When reverse engineering consumer hardware products, it can often be helpful to gain as much information as possible outside of the device itself, including: Service manuals Installation/User ...
10
votes
1answer
741 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
10
votes
1answer
8k views

Get code from protected PIC

I have a PIC18F4550 from an old device and I need to see the code. I tried reading it using my ICD3 programmer, but the chip seems to have its code protected. How can I get the code anyway?
10
votes
1answer
304 views

Breaking in and debugging an unknown Arduino program

Okay, so I've got an Arduino which has a sketch flashed to it (that I do not have source code for) which I'd like to reverse-engineer, and I've successfully dumped the flash and disassembled part of ...
9
votes
3answers
2k views

How to reverse engineer an ATM?

This question is using ATMs as an example, but it could apply to any number of 'secure' devices such as poker machines, E-voting machines, payphones etc. Given that ATMs are relatively hardened (in ...
9
votes
1answer
2k views

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
9
votes
2answers
969 views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
9
votes
3answers
451 views

Physically auditing the layout of transistors inside a processor made at 22mm process die

What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively ...
9
votes
2answers
1k views

Setting an USB Emulation and Fuzzing Platform?

I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device. First, I would like to know what are the most used hardware cards to ...
8
votes
1answer
900 views

How was the Zero Flag implemented on Z80 ALU?

Z80 was a popular 8-bit processor with a 4-bit ALU. Implementing a zero flag for a register should be straight forward, it would be a logical NOR of all the bits on the register. Something like that ...
8
votes
2answers
3k views

reverse engineering a printer cartridge chip

Is this stack only about reverse-engineering software and firmware? What about hardware? We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you). It has ...
8
votes
1answer
232 views

SCSI interface through USB

I'm trying to dump the storage of Xiaomi Home camera. It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device. I tried mounting the SCSI disc with no ...
7
votes
2answers
1k views

Router's serial port only outputs garbage

I'm trying to reverse engineer a 2Wire ADSL modem/router, mainly for practice. I opened it and found a serial port (with a header conveniently already in place) but I'm not getting any useful data out ...
7
votes
1answer
229 views

How can I work out which PCB layer a via goes to, without destroying the board?

I'm trying to reverse engineer some boards that have multiple layers, but can't figure out any way of discovering which layer certain vias go to. Unfortunately I can't destroy the board with ...
7
votes
1answer
3k views

Using MIPS EJTAG functionality in OpenOCD

I am trying to use the OpenOCD functionality of a BusBlaster to debug a MIPS target. However, it doesn't look as though my target MIPS chip is defined in the list of sample target chip configurations -...
7
votes
1answer
335 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
6
votes
1answer
241 views

What safety steps are to be followed when opening up an unknown piece of hardware?

I recently found a plastic box with various dials and unknown sockets on it, in my Grandfather's attic. It is around 12"x8"x4". From the plastic, it appears to be of 1980's vintage. I asked around, ...
6
votes
2answers
528 views

Which instrument is effective in discovering carrier frequency?

If two devices have wireless interconnection, how to detect carrier frequency? Range may vary in all radio, from FM, GSM to Wi-Fi and WiMax. Which tools are effective for doing this? Which one is ...
6
votes
3answers
4k views

Dump Flash Memory with SPI from SPANSION FL016KIF

I have a SPANSION FL016KIF (pinout on p.12) on a board and I want to dump the data. I try to use the BusPirate v3 for that. I want to do this in-circuit. I didn't connect WP# and HOLD#. This is the ...
6
votes
1answer
1k views

How can I figure out the device memory map for an embedded system?

On many embedded systems, a great deal of communication with devices is done by reading and writing to memory-mapped I/O (MMIO) addresses in software. Supposing that I have access to the physical ...
6
votes
1answer
222 views

How should I go about investigating an IC's functionality without destroying it?

I found a 14 pin integrated circuit with no visible markings. I have no information about its functioning. How should I go about trying to explore its functionality without destroying it ? I have a ...
6
votes
2answers
333 views

How do I figure out the which CPU the Sony DPF C-1000 has?

Recently I received a Digital Photo Frame (Sony C-1000) and since I'll never use it as it is, I thought of playing with it and reprogram it. Anything like managing to print out to screen "Hello world" ...
6
votes
2answers
2k views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
6
votes
1answer
240 views

How are achieved PUFs (Physicaly Unclonable Functions) and can we workaround?

I would like to know how are achieved PUFs (Physicaly Unclonable Functions) and if there is a way reverse these hardware electronic components ? Recent papers such as "Invasive PUF Analysis" present ...
6
votes
1answer
817 views

What is fault-injection reverse engineering? What are the techniques involved?

Trying to extract data from the hardware is often quite difficult (especially when dealing with smartcards). Fault-injection attacks allow to guess cryptographic keys based on the propagation of ...
6
votes
0answers
306 views

Hauppauge HVR-950Q - Linux - Signal Processing for extra data like subtitles [closed]

I have a Hauppauge HVR-950Q running on a stripped down debian. I am trying to use the Hauppauge HVR-950Q from the command line to parse subtitles and build a library of accurate subtitles. I am not ...
5
votes
2answers
393 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
5
votes
1answer
2k views

Question about Keeloq - A car remote control standard

I have a question about Keeloq security. I have an original car remote controller (BFT Mitto 2) and I know this chip uses HCS301 with Keeloq implementation. I would like to clone this remote for my ...
5
votes
1answer
1k views

What is SCARE (Side-Channel Attacks Reverse-Engineering)?

When reversing smart-cards, the side-channel attacks are known to be quite effective on hardware. But, what is it, and can it be used in software reverse-engineering and how?
5
votes
1answer
444 views

What can you find out about an unknown CPLD?

Sometimes you can find a CPLD (Complex Programmable Logic Device) on a circuit board. What can you do to find out what it is for? What are the limits and capabilities? What are common applications ...
5
votes
4answers
10k views

How to convert finished PCB to schematics effectively?

I have a PCB board that is a little involved to figure out its working. I spent a good day mapping trace by trace, node by node but still some node connections wouldn't make sense. I know designers ...
5
votes
1answer
1k views

Turning Technologies RF receiver

At my university we're required to purchase these RF clickers with an lcd screen so professors who choose to take attendance can do so in an automated fashion, and occasionally administer simple ...
5
votes
1answer
606 views

How to identify SWD (Serial Wire Debug) pinout?

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer. When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
4
votes
5answers
8k views

Reverse engineering modern Intel CPUs

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Is it simply possible, or are circuits closed and/or protected by proprietary technology?
4
votes
1answer
388 views

Potentially non-standard SPI communication

I am looking at a SPI EEPROM chip on board which is unfortunately hidden under an epoxy blob. However, I was able to determine the pinout thanks to the silkscreen. Dumping the EEPROM with a Bus ...