25

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an approach for digging into x86 chips and extracting hidden machine instructions. Title: Breaking the x86 ISA Abstract: A processor is not a ...


23

There are a few JTAG connectors available, so it's hard to tell which one, and how the pins are positioned. I suggest you take a magnifying glass and read the microcontroller model. With the model you will be able to find the datasheet on the Internet. Take a look at the PIN out of the microcontroller, and see how many JTAG outputs it has. Some newer chips ...


21

JTAG was initially created to test/verify hardware devices. The process is called boundary scanning and JTAG was named after the working group: Joint Test Action Group, some time in the 1980s. The idea was to define an interface that could be used to test hardware (micro controllers and connected peripherals after manufacturing). I.e. after development of ...


21

While FPGA makers don't just throw their formats out there, there is extensive documentation at a low level. Xilinx devices are a good example. To reverse engineer the bit stream you might generate test cases that implement simple logic and see how those translate to the bit stream, then move on to designs that exercise different portions of the chip. At ...


21

Although I think the questions are too broad and I agree with @cb88 that the datasheet should give you all you need to know, I'll try to answer some. How to dump the memory Desoldering First option is desoldering the chip from the board. After having done so you have 2 options Read the chip out using a chip programmer like e.g. Dataman that supports your ...


19

As you may suspect, it very much depends on the hardware. In general, you are correct, JTAG and/or UARTs can be often be used to get a copy of the firmware (downloading a firmware update from the vendor is usually the easiest way of course, but I'm assuming that is not what you mean). JTAG implementations typically allow you to read/write memory, and flash ...


15

What kind of further information are you looking for? I assume your goal is to read out the flash contents of an ATmega microcontroller. You found information on how the glitchers work, now I guess you want a confirmation that this is generally possible before committing to building one? In that case yes it's possible. I can't provide you any papers because ...


15

Problem description Let's make a couple of assumptions. Software is divided into functional components. Licenses are for functional components within that software package. Licenses can be based on time, on version or on a number of uses, i.e you may use the functionality until a set point in time, you may the functionality of the version you purchased or ...


15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array. Here is the output after this change: _this->ConfigSpace1 = configSpaceBuffer[1]; _this->ConfigSpace0 = configSpaceBuffer[0]; ...


15

I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works. The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the Wireshark protocl decoder for it here. However, to save you the time, I'll help you get to the meat of calculating those check bytes. In BACnet parlance, 55 ...


14

Clearly Peter has addressed the main points of proper implementation. Given that I have - without publishing the results - "cracked" two different dongle systems in the past, I'd like to share my insights as well. user276 already hints, in part, at what the problem is. Many software vendors think that they purchase some kind of security for their licensing ...


14

The markings look like an Atmel part (it starts with "AT", which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. Looking through Atmel's serial EEPROM datahsheets, your mystery chip is almost certainly an Atmel AT25128B-SSHL SPI EEPROM, which matches your chip's product ...


13

There are various techniques used and I'll list some. 1) Probing while operating - if you have a probe station you ca operate the device and probe intermediate signals within the die. This requires that the encapsulations (usually Si#N4 -or sometime Polyimide) needs to also have been removed. Once this is removed the chip has a limited life, but you can't ...


12

Well if you want to know how it was done exactly Then download the Z80 die shot of model you want to investigate, crop the ALU part and identify all the gates you can until you dig to Zero flag your self (sorry for indirect answer). Here my Z80 ALU post processed die shot white - metal green - poly-Si red - dopped-Si (diffusion) Gray - conductive ...


11

Some information might be found in Barnaby Jack's BlackHat presentation: Jackpotting Automated Teller Machines (Youtube) The most prevalent attacks on Automated Teller Machines typically involve the use of card skimmers, or the physical theft of the machines themselves. Rarely do we see any targeted attacks on the underlying software. Can't find the ...


11

The biggest danger from opening a piece of tech hardware (other than breaking it) is electrical shock. Equipment, especially older stuff, but really anything was designed to be plugged into the house mains may contain large capacitors in their power circuitry. These can store a surprising charge that would result in a major shock. Most modern equipment ...


11

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Not for modern CPUs. Not even for 10-15 years old CPUs. In 2015 the reverse engineering of Intel 8080 was finished, and this CPU is from 1974 year (actually, Soviet i8080 clone KR580VM80A from 1980s was reversed). Both CPUs were made with 6 μm feature size, ...


10

As Jason Geffner said its a DIN 45326 connector. As far as I know they're normally used in audio, but here is a pin out while used for serial. Next step would be using an Oscilloscope to determine the baud rate (and voltage). Often the oscilloscope software has some build in tools for automatically determining the baud rate. If not, you simple divide 1 by ...


9

Given you have a 14 pin package it could be almost anything from a op-amp(s) to 74XX series logic. Start with a continuity tester and see if there are any pins that are obviously shorted together. If so that would be a big hint that they maybe power rails. Also look for common pinouts (Vcc, Vss on corners pins 7,14 etc.). THen use a diode checker and to ...


9

But surely something must know where all the devices live in memory, because something is responsible for routing memory reads/writes to the correct device. In embedded devices there's nothing like PCI (well, it may be present but it's just one of the many HW blocks). So you can't just scan all possibilities to discover the existing devices. The code must ...


9

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure 1-2, from the datasheet, near "Transmitted information" at the bottom right: Using those three pieces of information you can theoretically create your own ...


9

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more interesting to look at software bugs (because they are more likely) than hardware bugs. Yet, you have a few occurrences of hardware bugs that led to disclosure of ...


8

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a board: static electricity. Every instruction to insert a PCI card in your computer comes with a warning about that, and there is a reason. However, i found ...


7

Peach is excellent at fuzzing smaller embedded systems. The configuration and detection is the big difference for embedded systems. This tends to change device to device, but one of my most used tools is the Cana Kit Relay Controller (http://www.canakit.com/4-port-usb-relay-controller.html). Peach has a monitor module that is able to trigger the relays. ...


7

According to J1708 a message is composed like this: byte 0 byte 1 byte 2 byte 3 to N byte N + 1 (N not to exceed 20) MID PID Data Addit. Pids & Data Checksum The checksum is calculated by adding all the bytes, invert it and add 1. A message is considerid valid if the message bytes + checksum = 0 (512). ...


7

You would probably need some expensive scanning equipment. It is possible you could get old equipment that is being discarded but that would be rather difficult. Then you would probably need to write software to handle the output of the equipment as you most likely wouldn't have a license for the accompaning software unless you nabbed a complete system ...


7

I don't have an actual answer but here's a few leads. Freescale has some chips in the i.MX6 family with the EPD interface: https://community.freescale.com/docs/DOC-93622 I think the signals are described in the CPU datasheet, but not the protocol. Even with the older devices when a dedicated controller had to be used, its datasheet would describe only the ...


7

I created a video how I identified a possible JTAG connection with a multimeter. Here is a picture showing which pins are connected and it matches with a standard JTAG pinout for VCC and GND. This is an indication that it could be JTAG, though it doesn't have to be.


7

There is no SPI specification that dictates things like read codes or address lengths, AFAIK; these are chip-specific and have been generally standardized by vendors of SPI EEPROMs and flash chips (though I"m not aware of any formal agreement among vendors). Most SPI EEPROMs use two bytes to specify the read address, because they are so small that they only ...


7

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You can check it yourself by looking at the file. 0000000000: E9 D5 01 EB 04 90 00 00 │ 00 52 8B C3 0E 07 66 33 0000000010: DB BA 01 00 E8 34 00 E9 │ 51 01 2E 88 ...


Only top voted, non community-wiki answers of a minimum length are eligible