Skip to main content
25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
knx's user avatar
  • 1,257
12 votes
Accepted

Advice on how to attack my first reverse engineering project?

It was made by humans so there's a spec. I googled it. Here's a manual which talks about the Axial MX from Accom ~2005. If it's a series of edit controllers, they'll likely work the same under the ...
pythonpython's user avatar
9 votes
Accepted

Thought I found serial port - broke embedded device instead! Help?

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
Guntram Blohm's user avatar
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
NirIzr's user avatar
  • 11.8k
9 votes

Knowledge about CPU hardware

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more ...
perror's user avatar
  • 19.1k
8 votes

Thought I found serial port - broke embedded device instead! Help?

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the ...
Spektre's user avatar
  • 1,384
7 votes
Accepted

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

I believe both keyfobs send the same data which is 1111 0000 0100 Second keyfob is repeating signal 3 times. DIP encoding to signal would be byte by byte with swapped nibbles. 00001111 10 => 11 ...
roscoe's user avatar
  • 186
6 votes
Accepted

How do I extract the firmware from this bluetooth speaker board?

Based on a datasheet found on Internet (http://www.lanzhi-tech.com/filedownload/99240) it seems that the ATS2815 is a chip that has everything to manage a Bluetooth speaker and, probably, it is inside ...
Valerio Di Giampietro's user avatar
5 votes

Trying to identify the JTAG/RS232 port on this board

J2 looks suspiciously close to the classic ARM 20-pin JTAG connector
Igor Skochinsky's user avatar
  • 36.7k
5 votes
Accepted

JTAG protection bypass

The question is kinda vague but here's some approaches that might work: Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes

Router's serial port only outputs garbage

If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock. I scaled the bottom half of your scope output by 500% horizontally, ...
Guntram Blohm's user avatar
4 votes

reverse engineering a printer cartridge chip

Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a ...
Spektre's user avatar
  • 1,384
4 votes
Accepted

Are there any project based books that teach reverse engineering?

You are right, most of the RE books out there are more generic and consists of dozens of different examples and not project oriented. Moreover, they're mostly focused on software reverse engineering. ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

Dumping a NAND Flash

It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
Igor Skochinsky's user avatar
  • 36.7k
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
Bavi_H's user avatar
  • 261
4 votes

Identify a chip that's very hot on PCB

Logo : Intersil DEYA could be ISL9000AIRNNZ see datasheet page 3 of http://res.ameya360.com/3C/DC/BF/ADE72A0B7B90509FB777F89C72_A.pdf Good luck
Gordon Freeman's user avatar
4 votes

trying to identify this SOP14 chip

I found out what it is it was an Inverting Schmitt trigger
Jwdsoft's user avatar
  • 191
4 votes

How do I extract the firmware from this bluetooth speaker board?

You may be right that the firmware is stored on the xt25f08b chip. It's not uncommon for firmware to be stored on a flash chip like that, and I don't see any other storage. One fairly simple way is to ...
multithr3at3d's user avatar
3 votes
Accepted

How to identify unknown chip

Aveo is aveo technolgy corp some software related to usb uvc camera seens ti be available here. http://aveo.drivers.informer.com/ not sure if the links are geniune appears to be collated ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

What is the encoding of some old arcade chips?

These four files are 2 interleaved sets of ROMs for the arcade game "Pot-O-Gold", by Leisure Time Technology, dated "OCTOBER 1999". This image shows your labelled chips, also bearing the abbreviation ...
Jongware's user avatar
  • 2,364
3 votes

Router's serial port only outputs garbage

Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's ...
marcan's user avatar
  • 131
3 votes

Reverse engineering modern Intel CPUs

From a now deleted Quora comment: Smart Imaging Technologies (archive) can reverse to the gate level and output VHDL, but I don't know at which cost 3D x-ray tomography is a new technique in vogue, ...
Ciro Santilli OurBigBook.com's user avatar
3 votes

Understand hardware breakPoint option in ida

The options are explained in the help but I guess it could be a little laconic. The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes
Accepted

Limited U-Boot options, any memory reading possibilities here?

Well I come up with two way. The first one is a difficult way. I've looked up some resource and found that the upf command on Hikvision camera should be able to update the firmware, and it's using ...
Misty's user avatar
  • 428
3 votes
Accepted

router: how to break into boot?

I hope you could already solve your problem. Just in case that you are still struggling I want to share my ideas with you. I just want to point out that I am not 100% sure. As Gogeta70 already said ...
Ramazuri's user avatar
  • 108
3 votes
Accepted

Identify unknown Atmel chip

https://www.waveshare.net/datasheet/ATMEL_PDF/AT24C512C.PDF |---|---|---|---|---|---|---|---| A T M L H Y W W |---|---|---|---|---|---|---|---| 2 F C M @ |---|---|...
mumbel's user avatar
  • 441
3 votes
Accepted

Need help identifying this IC

This is an AT42QT2120 QTouch sensor IC from Atmel.
user42194's user avatar
2 votes

Reverse engineering T-Disk barcodes for Tassimo coffee makers

First of all, I only wanted to post a comment, but the reputation system wouldn't let me, because I'm new here. My research showed the following: For this project we have do distinguish between two ...
schoeM's user avatar
  • 21
2 votes

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)
Remko's user avatar
  • 3,273

Only top scored, non community-wiki answers of a minimum length are eligible