Questions tagged [hardware]

Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering.

Filter by
Sorted by
Tagged with
7
votes
1answer
335 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
1
vote
1answer
573 views

Finding base address U-boot Android image from /dev/block/mmcblk0boot0

Currently I am stuck finding the base address for IDA to disassemble the boot image correctly. The img file is coming from /dev/block/mmcblk0boot0 (mcc_utils is executing: cat bootarea.img > dev/...
3
votes
1answer
479 views

How to identify unknown chip

I'm trying to play with the internals of a toy and the controller for that toy uses a chip that I have been unable to find any information on. The chip in question is this: The company is clearly ...
3
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
1
vote
3answers
601 views

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Here's the attached image: (source: gsmsolutions.ie) The CA-50 was used by Nokia to program newer phones. Nokia phones from around 2008-2011 feature this port for flashing. I noticed the USB side ...
1
vote
1answer
935 views

How to reverse engineer hex data on EEprom? [closed]

I am learning how to reverse engineer the EEprom data in Automotive ECUs. For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things. I ...
4
votes
1answer
237 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
0
votes
1answer
156 views

reverse engineering of electronics of father.io game [closed]

Father.io game has recently become a famous AR FPS game. I want to know the concept of this game electronics design and ideas? I'm planning with some friends of me to make a shooting game like Father....
1
vote
0answers
99 views

Patch is detected yet hardware access breakpoint isn't hit

I wonder how is that possible. I found debugger detection in TLS Callback function - there is conditional jump after some check. When I step over it with debugger and modify ZF flag to bypass ...
5
votes
2answers
393 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
8
votes
2answers
3k views

reverse engineering a printer cartridge chip

Is this stack only about reverse-engineering software and firmware? What about hardware? We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you). It has ...
4
votes
1answer
539 views

What is the encoding of some old arcade chips?

So I got a couple super old chips from what looked like an arcade. The game-board they game with is OK I think. The CRT monitor is wrecked, however the chips are still good. I stuck them in my Chip ...
1
vote
0answers
302 views

Discovering byte array obfuscation function

I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host ...
7
votes
2answers
1k views

Router's serial port only outputs garbage

I'm trying to reverse engineer a 2Wire ADSL modem/router, mainly for practice. I opened it and found a serial port (with a header conveniently already in place) but I'm not getting any useful data out ...
0
votes
1answer
47 views

Why do Mobile Credit Card Devices use the TRRS connection instead of the Micro USB?

I didn't know where to ask this; I hope it's in the proper place. My wife just bought one of these mobile credit card processing devices for her phone and I was curious as to why these devices use ...
2
votes
1answer
653 views

Best 3G USB Modem for Reverse Engineering?

My idea is to automate the process of keeping in touch with my server in a portable and internet independent manner. The most optimal solution in my case is an SMS Gateway/Relay because I travel a lot ...
5
votes
1answer
2k views

Question about Keeloq - A car remote control standard

I have a question about Keeloq security. I have an original car remote controller (BFT Mitto 2) and I know this chip uses HCS301 with Keeloq implementation. I would like to clone this remote for my ...
2
votes
1answer
436 views

Reverse engineering car stereo panel

I'd like to reverse engineer a car stereo front removable panel. It's a leftover from a broken car stereo. I'd like to do so by connecting the panel's 14 connections to Raspberry Pi 2 model B's GPIO ...
2
votes
0answers
285 views

What optics are used in Microsoft HoloLens?

How does Microsoft project an image so close to the eye yet understandable by the brain? How is the display transparent? This link has good information but is speculative. https://www.reddit.com/r/...
3
votes
1answer
612 views

Reverse engineer intercom connection (22pin internal connector)

I have a Urmet Signo 1740/40 intercom device in my apartment, and I've been brooding on a way to replicate (some of) its functionality from a different device (such as a Raspberry Pi) so that I can ...
3
votes
1answer
233 views

Chip obscuring epoxy removal for chip identification?

I have a chip on a DJI Phantom 3 Advanced controller/remote. It is the RF communications chip, which I believe to be some sort of Analog Devices wireless networking chip, but I'm not sure exactly ...
2
votes
2answers
237 views

I need advice on how to JTag a Microsoft Band

I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a ...
0
votes
2answers
569 views

How to get x and y position from joystick?

I have VR2 Joystick and I want to hack it. What I think is that, to determine analog voltage of joystick outpin and to mimic this values in Arduino with AnalogWrite function. I tried measure analog ...
2
votes
1answer
618 views

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it. I am wondering if there are any emulators that ...
3
votes
0answers
93 views

“Sound Box” Custom Message

I am trying to put a custom message on a "sound box" in a stuffed animal. Here is a picture of the circuit board: The blue wires lead are connected to the speaker. I am thinking that those pads ...
0
votes
1answer
187 views

How can I detect what's calling an .exe when pressing a keyboard button? (and hook it)

On my keyboard, there's a button that opens Windows 7 calculator when pressed. How would you capture what's calling/opening it? Because it's a Logitech keyboard, common sense would say it's via ...
1
vote
1answer
122 views

Reverse Engineering an iBaby M6

The iBaby M6 is a pretty cool baby monitoring system with neat features. It has Android and iPhone apps but unfortunately, there's no PC interface. I was thinking that if the camera was broadcasting ...
8
votes
1answer
900 views

How was the Zero Flag implemented on Z80 ALU?

Z80 was a popular 8-bit processor with a 4-bit ALU. Implementing a zero flag for a register should be straight forward, it would be a logical NOR of all the bits on the register. Something like that ...
9
votes
1answer
2k views

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
1
vote
1answer
86 views

How to accurately virtualize bespoke hardware?

Here's my situation: I hate firewalls, load balancers, routers etc... want to root em all! Anyway, I can't buy em all, and a lot of people think that it's dumb to buy them anyway. Why? So the ...
3
votes
1answer
831 views

Reversing serial RS485 half duplex bus protocol understanding

I have a master & slaves setup in which the slaves only respond when spoken too. I can snoop & record an existing master/slaves conversation. I have an extra slave device that I would like ...
1
vote
2answers
2k views

How was Playstation Portable hacked? How is custom firmware developed? [closed]

How was PSP hacked? On first hand, how do people rip the binary out of PSP? I am just curious how all those hardware reverse engineering works. P.S. Is there a PSP Custom firmware developer ...
0
votes
0answers
1k views

Emulating a sentinel c-plus security dongle to attach to a virtual machine

My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS http://www.theos-software.com/ ...
0
votes
1answer
209 views

Laptop monitor backlight [closed]

I've had two laptops, one Sony and another Acer. Sony laptops backlight can be decreased quite a bit, however the Acer laptops backlight brightness is too much. I was wondering where these values sit ...
0
votes
0answers
1k views

How to hack a digital photo frame to remove JPEG compression?

I have purchased this digital photo frame: http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en&currency=USD[1] I am ...
1
vote
1answer
622 views

Storing files on keyboard memory

Is it theoretically possible to take these new smarter keyboards such as the K70 RGB and tap into the onboard memory which in the case of the K70 RGB, is used for storing lighting profiles and the ...
2
votes
1answer
584 views

Windows boot process doesn't make sense!

Here is my question: How can the Windows 7, 8, etc. boot process work? The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense: An ...
13
votes
3answers
28k views

Extracting a firmware image via U-Boot

I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC. I'm trying to get access to the device. It has a hardware serial port, and I've gotten ...
1
vote
0answers
598 views

How to get frame sync signal from a GoPro Dual HERO System sync cable? [closed]

I need to frame sync a GoPro Dual HERO System with an external data logger. So the main problem is to get the HERO frame synchronization signal (I guess there must be one in the cable) from their ...
1
vote
1answer
719 views

In-circuit programming of SPI Flash memory

Is it possible to define (using only visual inspection of PCB and multimeter) whether or not SPI Flash memory can be properly programmed keeping the device In-circuit, without desoldering IC from the ...
2
votes
2answers
1k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
4
votes
5answers
8k views

Reverse engineering modern Intel CPUs

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Is it simply possible, or are circuits closed and/or protected by proprietary technology?
1
vote
0answers
126 views

Serial console stops output abruptly

I've been playing with a device similar to this one: EPC3208G. I've connected GND, TX and what i think is an RX pins via ttl adapter. Using minicom, 8N1 and baudrate of 115200, I managed to get some ...
2
votes
2answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
9
votes
2answers
1k views

Setting an USB Emulation and Fuzzing Platform?

I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device. First, I would like to know what are the most used hardware cards to ...
11
votes
4answers
3k views

Identifying an unknown chip on a PCB

I'm working on reverse engineering a PCB (no documentation by manufacturer). I've identified all the other chips on this board but this one refuses to give up any google-able info. Are there any ...
1
vote
1answer
697 views

Can Trusted computing/TPM defeat crack attempts?

I read some things about trusted computing platforms (TPM) and its applications in the past. AFAIK, its applications include such things as countering software reverse engineering/crack and cheating ...
10
votes
1answer
304 views

Breaking in and debugging an unknown Arduino program

Okay, so I've got an Arduino which has a sketch flashed to it (that I do not have source code for) which I'd like to reverse-engineer, and I've successfully dumped the flash and disassembled part of ...
33
votes
7answers
30k views

Reverse engineering T-Disk barcodes for Tassimo coffee makers

In hope this is appropriate I have a Bosch Tassimo TAS2002EE coffee maker that uses T-Disks. Those contain coffee/milk/something else, and a barcode that is supposed to tell the machine how to deal ...
4
votes
1answer
388 views

Potentially non-standard SPI communication

I am looking at a SPI EEPROM chip on board which is unfortunately hidden under an epoxy blob. However, I was able to determine the pinout thanks to the silkscreen. Dumping the EEPROM with a Bus ...