25
votes
Knowledge about CPU hardware
To extend the answer of perror:
Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
- 1,257
12
votes
Accepted
Advice on how to attack my first reverse engineering project?
It was made by humans so there's a spec.
I googled it.
Here's a manual which talks about the Axial MX from Accom ~2005. If it's a series of edit controllers, they'll likely work the same under the ...
- 878
9
votes
Accepted
Thought I found serial port - broke embedded device instead! Help?
Frying your board:
Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
- 12.9k
9
votes
Question about Keeloq - A car remote control standard
To create a full duplicate, able to generate valid transmission packets you'll need the following information:
Serial Number
Button press mapping
32 bit of KeeLoq encrypted data
See attached Figure ...
- 11.7k
9
votes
Knowledge about CPU hardware
In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time.
Therefore, it is much more ...
- 18.9k
8
votes
Thought I found serial port - broke embedded device instead! Help?
I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already).
Single pin touching with a probe can blow up your HW.
And I do not mean the ...
- 1,384
7
votes
Accepted
HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)
I believe both keyfobs send the same data which is
1111 0000 0100
Second keyfob is repeating signal 3 times.
DIP encoding to signal would be byte by byte with swapped nibbles.
00001111 10 => 11 ...
- 186
6
votes
Accepted
Reverse engineering car stereo panel
The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
- 20.7k
6
votes
Accepted
How do I extract the firmware from this bluetooth speaker board?
Based on a datasheet found on Internet (http://www.lanzhi-tech.com/filedownload/99240) it seems that the ATS2815 is a chip that has everything to manage a Bluetooth speaker and, probably, it is inside ...
5
votes
Trying to identify the JTAG/RS232 port on this board
J2 looks suspiciously close to the classic ARM 20-pin JTAG connector
- 36.4k
5
votes
Accepted
JTAG protection bypass
The question is kinda vague but here's some approaches that might work:
Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value ...
- 36.4k
4
votes
Reverse engineer intercom connection (22pin internal connector)
Unless you don't mind destroying a few Raspberry Pi boards, I'd strongly advise against just hooking this up to Pi GPIO pins! This kind of connector is common, but the pinout is unlikely to be ...
- 2,521
4
votes
I need advice on how to JTag a Microsoft Band
You have picked a particularly hard target to try and find JTAG on, if this is your first project.
There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so ...
- 1,762
4
votes
Router's serial port only outputs garbage
If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock.
I scaled the bottom half of your scope output by 500% horizontally, ...
- 12.9k
4
votes
reverse engineering a printer cartridge chip
Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a ...
- 1,384
4
votes
Accepted
Are there any project based books that teach reverse engineering?
You are right, most of the RE books out there are more generic and consists of dozens of different examples and not project oriented. Moreover, they're mostly focused on software reverse engineering. ...
- 8,919
4
votes
Accepted
Dumping a NAND Flash
It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
- 36.4k
4
votes
Accepted
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
Binary
MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127.
In a 7-bit binary number:
the bit on the right represents a decimal value of 1.
the next bit to the left ...
- 261
4
votes
Identify a chip that's very hot on PCB
Logo : Intersil
DEYA could be ISL9000AIRNNZ see datasheet page 3 of
http://res.ameya360.com/3C/DC/BF/ADE72A0B7B90509FB777F89C72_A.pdf
Good luck
- 416
4
votes
4
votes
How do I extract the firmware from this bluetooth speaker board?
You may be right that the firmware is stored on the xt25f08b chip. It's not uncommon for firmware to be stored on a flash chip like that, and I don't see any other storage.
One fairly simple way is to ...
- 609
3
votes
Accepted
How to identify unknown chip
Aveo is aveo technolgy corp some software related to usb uvc camera seens ti be available here.
http://aveo.drivers.informer.com/ not sure if the links are geniune appears to be collated ...
- 16.3k
3
votes
Accepted
What is the encoding of some old arcade chips?
These four files are 2 interleaved sets of ROMs for the arcade game "Pot-O-Gold", by Leisure Time Technology, dated "OCTOBER 1999".
This image shows your labelled chips, also bearing the abbreviation ...
- 2,354
3
votes
Router's serial port only outputs garbage
Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's ...
- 131
3
votes
Reverse engineering modern Intel CPUs
From a now deleted Quora comment:
Smart Imaging Technologies (archive) can reverse to the gate level and output VHDL, but I don't know at which cost
3D x-ray tomography is a new technique in vogue, ...
3
votes
Understand hardware breakPoint option in ida
The options are explained in the help but I guess it could be a little laconic.
The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and ...
- 36.4k
3
votes
Accepted
Limited U-Boot options, any memory reading possibilities here?
Well I come up with two way.
The first one is a difficult way. I've looked up some resource and found that the upf command on Hikvision camera should be able to update the firmware, and it's using ...
- 428
3
votes
Accepted
router: how to break into boot?
I hope you could already solve your problem.
Just in case that you are still struggling I want to share my ideas with you.
I just want to point out that I am not 100% sure.
As Gogeta70 already said ...
- 108
3
votes
Accepted
Identify unknown Atmel chip
https://www.waveshare.net/datasheet/ATMEL_PDF/AT24C512C.PDF
|---|---|---|---|---|---|---|---|
A T M L H Y W W
|---|---|---|---|---|---|---|---|
2 F C M @
|---|---|...
- 441
Only top scored, non community-wiki answers of a minimum length are eligible