25

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an approach for digging into x86 chips and extracting hidden machine instructions. Title: Breaking the x86 ISA Abstract: A processor is not a trusted black box for ...


21

As you may suspect, it very much depends on the hardware. In general, you are correct, JTAG and/or UARTs can be often be used to get a copy of the firmware (downloading a firmware update from the vendor is usually the easiest way of course, but I'm assuming that is not what you mean). JTAG implementations typically allow you to read/write memory, and flash ...


15

I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works. The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the Wireshark protocl decoder for it here. However, to save you the time, I'll help you get to the meat of calculating those check bytes. In BACnet parlance, 55 ...


14

The markings look like an Atmel part (it starts with "AT", which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. Looking through Atmel's serial EEPROM datahsheets, your mystery chip is almost certainly an Atmel AT25128B-SSHL SPI EEPROM, which matches your chip's product ...


13

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Not for modern CPUs. Not even for 10-15 years old CPUs. In 2015 the reverse engineering of Intel 8080 was finished, and this CPU is from 1974 year (actually, Soviet i8080 clone KR580VM80A from 1980s was reversed). Both CPUs were made with 6 μm feature size, ...


13

Well if you want to know how it was done exactly Then download the Z80 die shot of model you want to investigate, crop the ALU part and identify all the gates you can until you dig to Zero flag your self (sorry for indirect answer). Here my Z80 ALU post processed die shot white - metal green - poly-Si red - dopped-Si (diffusion) Gray - conductive ...


12

It was made by humans so there's a spec. I googled it. Here's a manual which talks about the Axial MX from Accom ~2005. If it's a series of edit controllers, they'll likely work the same under the hood and use the same protocol from one version to the next. Looks like an RS422 Serial. So you just need to hook it up to a computer with a serial port and take ...


9

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure 1-2, from the datasheet, near "Transmitted information" at the bottom right: Using those three pieces of information you can theoretically create your own ...


9

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a board: static electricity. Every instruction to insert a PCI card in your computer comes with a warning about that, and there is a reason. However, i found ...


9

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more interesting to look at software bugs (because they are more likely) than hardware bugs. Yet, you have a few occurrences of hardware bugs that led to disclosure of ...


8

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the obvious static charge or what so ever from the common reasons. With nowadays chips some pins runs on very specific voltage ranges and even a high impedance ...


7

Extracting the content of a hardware chip is known as "snarf"ing. (That term may help with your Google searches.) To snarf the contents of a chip, you need a ROM reader/programmer, such as one of the devices from http://www.needhams.com/programmers.htm


7

There is no SPI specification that dictates things like read codes or address lengths, AFAIK; these are chip-specific and have been generally standardized by vendors of SPI EEPROMs and flash chips (though I"m not aware of any formal agreement among vendors). Most SPI EEPROMs use two bytes to specify the read address, because they are so small that they only ...


7

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You can check it yourself by looking at the file. 0000000000: E9 D5 01 EB 04 90 00 00 │ 00 52 8B C3 0E 07 66 33 0000000010: DB BA 01 00 E8 34 00 E9 │ 51 01 2E 88 ...


7

I believe both keyfobs send the same data which is 1111 0000 0100 Second keyfob is repeating signal 3 times. DIP encoding to signal would be byte by byte with swapped nibbles. 00001111 10 => 11 11 00 00 01 Try to use Autodetect parameters in URH.


6

Consider the code that you were able to modify. The decimal representation of your modified code is 065375. The checksum of 064095 = 3*0 + 6 + 3*4 + 0 + 3*9 + 5 = 50 (≡ 0 mod 10). The checksum of 065375 = 3*0 + 6 + 3*5 + 3 + 3*7 + 5 = 50 (≡ 0 mod 10). So it seems that this disk was accepted because the checksum matched, while your other disks weren't ...


6

First a thought regarding the volumes that don't seem to line up. The first link in the Q discusses purge and charge sections - these will contribute to the volume and it's possible that the table of volumes assumes some contribution from these processes that may not be the minimum Second - some more data for you: We have a water dispenser disc (it ...


6

The way I did it on the Kindle was to load the flash partitions into memory and then using memory dump commands to dump them in hex format (and then some Python script to convert hex back to binary). It was kinda slow but did achieve the goal. Your U-Boot does not seem to have the bbm command but fload - load binary file from a filesystem image for system ...


6

I use sf read and it works pretty good. It can be called as follows sf read [addr] [offset] [len] So for your case, reading romfs would look like this: sf probe 0; sf read 0x82000000 0x40000 0x370000 Then you can transfer the file to tftp server: tftp 0x82000000 romfs.cramfs 0x370000 You can also use sf to write to the SPI flash (more info can be ...


6

The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That device's service manual contains the following diagram for the back of the faceplate: As you can see above, the pins are (beginning from top-right, moving ...


5

Costa Costa Americano (220ml) 297615 (single T Disc) Costa Cappuccino (215ml) Costa Espresso for Cappuccino & Latte 022095 Creamer (S) for Cappuccino 061827 Costa Caramel Latte (320ml) Costa Espresso for Cappuccino & Latte 022095 Creamer (L) for Caramel Latte 637350 Cadbury Cadbury Hot Chocolate (265ml) Cadbury Hot Chocolate 066655 Creamer (S) ...


5

This video on YouTube can be a good start. Reverse Engineering the MOS 6502 CPU [27C3 (Chaos Computer Congress)]. Watching the video from minute 25 to 30 you can see how CPU dice was exposed and how the data were processed. Basically hi-res photos were stitched together and traced to create a vector image. This in turned was used to create a netlist used ...


5

J2 looks suspiciously close to the classic ARM 20-pin JTAG connector


5

The question is kinda vague but here's some approaches that might work: Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value of the fuse, or change in the code flow in case the check is implemented in software. For an example of this technique see Breaking Code Read Protection on the ...


4

I've got a lead!! I've looked over a lot of the data, and I think that people are getting distracted by the decimal representations of the binaries. We need to just focus on the binaries. I first got that idea from a mysteriously precise comment on the chapman consulting post. Seems like someone with some inside knowledge, possibly. GSerg, the OP, posted a ...


4

Petteri Aimonen has figured out how to drive the panel and Sprite_tm made a wireless display out of one


4

Looking at the kernel source for the kindle touch (mx50_yoshi.c, see here) it seems to me that the epd configuration, init sequence and so on is all there. I only checked for the touch cause the touch eink seems to be currently the cheapest. (ED060SCG) Code static struct fb_videomode e60_v220_mode = { .name = "E60_V220", .refresh = 85, .xres = 800, ...


4

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for both the SOC you're dealing with and the hardware board you're going to have to reverse engineer the firmware of the device. This will allow you to figure out ...


4

You have picked a particularly hard target to try and find JTAG on, if this is your first project. There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so you can't trace the pins from there. Same with the flash. It is almost certainly a multi-layer board as well. So there are a number of options: It may never ...


4

Unless you don't mind destroying a few Raspberry Pi boards, I'd strongly advise against just hooking this up to Pi GPIO pins! This kind of connector is common, but the pinout is unlikely to be standardized. You're going to have to do some investigation to figure it out. Here's the approach I'd use. Trace the pins This circuit board is not to large but ...


Only top voted, non community-wiki answers of a minimum length are eligible