25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
user avatar
  • 1,227
16 votes
Accepted

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I downloaded the EZ-ZONE Configurator and reverse engineered it to see how it works. The serial data you're seeing is actually the BACnet MS/TP (master-slave/token-passing) protocol. You can find the ...
user avatar
14 votes
Accepted

Identifying an unknown chip on a PCB

The markings look like an Atmel part (it starts with "AT", which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. ...
user avatar
  • 2,654
13 votes

Reverse engineering modern Intel CPUs

Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Not for modern CPUs. Not even for 10-15 years old CPUs. In 2015 the reverse engineering of Intel ...
user avatar
  • 231
13 votes
Accepted

How was the Zero Flag implemented on Z80 ALU?

Well if you want to know how it was done exactly Then download the Z80 die shot of model you want to investigate, crop the ALU part and identify all the gates you can until you dig to Zero flag your ...
user avatar
  • 1,374
12 votes
Accepted

Advice on how to attack my first reverse engineering project?

It was made by humans so there's a spec. I googled it. Here's a manual which talks about the Axial MX from Accom ~2005. If it's a series of edit controllers, they'll likely work the same under the ...
user avatar
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
user avatar
  • 11.4k
9 votes
Accepted

Thought I found serial port - broke embedded device instead! Help?

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
user avatar
9 votes

Knowledge about CPU hardware

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more ...
user avatar
  • 18.1k
8 votes

Thought I found serial port - broke embedded device instead! Help?

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the ...
user avatar
  • 1,374
7 votes

Windows boot process doesn't make sense!

(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different) The boot manager is not a PE, or, rather, not just a PE. It starts with 16-bit realmode part. You ...
user avatar
  • 34.9k
7 votes
Accepted

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

I believe both keyfobs send the same data which is 1111 0000 0100 Second keyfob is repeating signal 3 times. DIP encoding to signal would be byte by byte with swapped nibbles. 00001111 10 => 11 ...
user avatar
  • 186
6 votes

Extracting a firmware image via U-Boot

The way I did it on the Kindle was to load the flash partitions into memory and then using memory dump commands to dump them in hex format (and then some Python script to convert hex back to binary). ...
user avatar
  • 34.9k
6 votes

Extracting a firmware image via U-Boot

I use sf read and it works pretty good. It can be called as follows sf read [addr] [offset] [len] So for your case, reading romfs would look like this: sf probe 0; sf read 0x82000000 0x40000 ...
user avatar
6 votes

Reverse engineering T-Disk barcodes for Tassimo coffee makers

First a thought regarding the volumes that don't seem to line up. The first link in the Q discusses purge and charge sections - these will contribute to the volume and it's possible that the table ...
user avatar
  • 161
6 votes
Accepted

Reverse engineering car stereo panel

The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That ...
user avatar
5 votes

Trying to identify the JTAG/RS232 port on this board

J2 looks suspiciously close to the classic ARM 20-pin JTAG connector
user avatar
  • 34.9k
5 votes
Accepted

JTAG protection bypass

The question is kinda vague but here's some approaches that might work: Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value ...
user avatar
  • 34.9k
4 votes

Reverse engineering T-Disk barcodes for Tassimo coffee makers

I've got a lead!! I've looked over a lot of the data, and I think that people are getting distracted by the decimal representations of the binaries. We need to just focus on the binaries. I first got ...
user avatar
4 votes

E Ink display interface protocol

Petteri Aimonen has figured out how to drive the panel and Sprite_tm made a wireless display out of one
user avatar
  • 34.9k
4 votes

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for ...
user avatar
4 votes

I need advice on how to JTag a Microsoft Band

You have picked a particularly hard target to try and find JTAG on, if this is your first project. There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so ...
user avatar
  • 1,672
4 votes

Reverse engineer intercom connection (22pin internal connector)

Unless you don't mind destroying a few Raspberry Pi boards, I'd strongly advise against just hooking this up to Pi GPIO pins! This kind of connector is common, but the pinout is unlikely to be ...
user avatar
  • 2,426
4 votes

Router's serial port only outputs garbage

If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock. I scaled the bottom half of your scope output by 500% horizontally, ...
user avatar
4 votes

reverse engineering a printer cartridge chip

Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a ...
user avatar
  • 1,374
4 votes
Accepted

Are there any project based books that teach reverse engineering?

You are right, most of the RE books out there are more generic and consists of dozens of different examples and not project oriented. Moreover, they're mostly focused on software reverse engineering. ...
user avatar
  • 8,659
4 votes
Accepted

Dumping a NAND Flash

It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
user avatar
  • 34.9k
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
user avatar
  • 156
4 votes

Identify a chip that's very hot on PCB

Logo : Intersil DEYA could be ISL9000AIRNNZ see datasheet page 3 of http://res.ameya360.com/3C/DC/BF/ADE72A0B7B90509FB777F89C72_A.pdf Good luck
user avatar
4 votes

trying to identify this SOP14 chip

I found out what it is it was an Inverting Schmitt trigger
user avatar
  • 191

Only top scored, non community-wiki answers of a minimum length are eligible