Reverse engineering of a Nevo C2 remote control from Arantius.com Most recently I’ve switched to the “Nevo C2” remotes (also known as “Xsight Color” or “ARRX15G”), which have a graphical display built in. This makes it easy for me to deal with the huge array (TiVo, HTPC, plus eleven game consoles) of devices I’ve got hooked […]
Category Archives: reversed
555 timer teardown: Inside the world’s most popular IC
Another great teardown article by Ken Shirriff, a look inside the 555 timer chip: Given the popularity of the 555 timer, I thought it would be interesting to find out what’s inside the 555 timer and how it works. While the 555 timer is usually sold as a black plastic IC, it is also available […]
Inside the arm1v – the ALU control logic
Dave writes: This is one of a number of posts on my work on reverse engineering the armv1 processor. The first in the series, and an index of the other articles can be found here. My first post in this series described in some detail a one-bit slice of the ALU, and identified quite a […]
More ARM1 processor reverse engineering: the priority encoder
In a previous post, Ken Shirriff reverse engineered the silicon in the ARM1 processor, this time he reverse-engineer the priority encoder in the ARM1 processor: In this article, I reverse-engineer the priority encoder in the ARM1 processor. By examining the chip layout provided by the Visual ARM1 project, I have determined how this circuit works […]
Counting bits in hardware: Reverse engineering the silicon in the ARM1 processor
Ken Shirriff writes: How can you count bits in hardware? In this article, I reverse-engineer the circuit used by the ARM1 processor to count the number of set bits in a 16-bit field, showing how individual transistors form multiplexers, which are combined into adders, and finally form the bit counter. The ARM1 is the ancestor […]
Reverse engineering the ARM1, ancestor of the iPhone’s processor
Another great article from Ken Shirriff, this time on reverse engineering the ARM1: Almost every smartphone uses a processor based on the ARM1 chip created in 1985. The Visual ARM1 simulator shows what happens inside the ARM1 chip as it runs; the result (below) is fascinating but mysterious.[1] In this article, I reverse engineer key […]
Reverse engineering the ESP8266 WIFI-to-Serial port adapter
Here’s a video from electronupdate on reverse engineering the ESP8266 WIFI-to-Serial port adapter: Another very interesting bit of technology. The combination of so much functionality into such a small part is a real touch-stone as to where things are heading. A quick look at the antenna design to see if I could sort down the […]
Looking inside a silicon die
electronupdate writes: A very interesting branch of electrical engineering is the reverse engineering and analysis of silicon dies of semiconductors. The tools to play in this field are very specialized and I suspect very expensive. In this video I went for the spend-no-money approach to see how far I could get at doing a top-side […]
Understanding silicon circuits: inside the ubiquitous 741 op amp
Ken Shirriff’s writes, “The 741 op amp is one of the most famous and popular ICs with hundreds of millions sold since its invention in 1968 by famous IC designer Dave Fullagar. In this article, I look at the silicon die for the 741, discuss how it works, and explain how circuits are built from […]
Schlumberger 4002 signal generator
Mario wrote an article on reverse engineering a Schlumberger 4002 signal generator: What I got was a Schlumberger 4002 signal generator. It ranges from 0.1 to 2160 MHz with 10-20 Hz tuning accuracy, selectable output amplitude from -138.9 dBm up to +13 dBm in 0.1 dB steps, auto-sweeping and several extras like an OCXO for stability, 20 dB […]
Examining the core memory module inside a vintage IBM 1401 mainframe
Ken Shirriff writes: The IBM 1401 mainframe computer was announced in 1959 and by the mid-1960s had become the best-selling computer, extremely popular with medium and large businesses because of its low cost. A key component of the 1401’s success was its 4,000 character core memory, which stored data on tiny magnetized rings called cores. […]
Sniffing Crazyflie’s radio with HackRF blue
arnaud acquired a HackRF Blue and has been busy coding up a GNURadio project for analyzing Crazyflie radio transmissions. Crazyflie is a nano quadcopter/drone controlled over a wireless link. The Crazyradio is the official radio dongle for the Crazyflie Nano Quadcopter. It is a 2.4GHz USB radio dongle based on the nRF24LU1+ chip from Nordic […]
Reverse engineering a Beseler PM2L Color Analyzer
Kerry Wong wrote an article on reverse engineering a Beseler PM2L Color Analyzer: I recently acquired an old Beseler PM2L color analyzer. This kind of color analyzer was designed to analyze the color or exposure of film negatives at a certain location by comparing the intensity of the filtered light of each color channel (CMY and white). […]
Reverse engineering the Panasonic AC infrared protocol
The AnalysIR Team hailing from Dublin, Ireland has just published a new article called. “Reverse engineering the Panasonic AC Infrared protocol”. If you’re into IR hacking with the USB IR Toy, check this out. “AnalysIR is an advanced IR analyzer & decoder that works with Arduinos, Raspberry Pi, USB IR Toy, Teensy3, ChipKit Fubarino and […]
Reverse engineering a Verisure wireless alarm
Here’s an informative two-part series of posts over at FunOverIP detailing how to reverse engineer a Verisure wireless alarm. Part 1 details the beginning steps such as finding the modules radio frequency and modulation type, analyzing the chipset datasheet and using GNU Radio.
Reversing D-Link’s WPS Pin Algorithm
Craig of /dev/ttyS0 wrote an article on reversing D-Link’s WPS Pin Algorithm: While perusing the latest firmware for D-Link’s DIR-810L 80211ac router, I found an interesting bit of code in sbin/ncc, a binary which provides back-end services used by many other processes on the device, including the HTTP and UPnP servers I first began examining this particular piece […]
Video: Hack All The Things – 20 Devices in 45 Minutes
The GTVHacker group gave this presentation at DEFCON 22. The group is famous for Hacking the Google TV a few years back, and in this talk they add plenty of devices to their credit. “We’ve taken all of our previous experience exploiting embedded devices and used it to bring you a presentation filled with more […]
Derbycon video: Making BadUSB Work For You
Adam Caudill and Brandon Wilson gave this presentation at the recent Derbycon 2014 conference in Louisville, KY, covering their hack of the Phison 2251-03 USB controller firmware to add new “features” and functionality. They focus on the Patriot Supersonic Xpress 8GB USB drive allowing it to be repurposed for non-standard uses. Adam has posted his […]
Reverse engineering wireless pro studio lighting
Richard Webb just finished an article on reverse engineering the wireless protocol used to communicate with some pro studio lighting. His approach involves sniffing the SPI bus into the lighting controller’s RF module using the Open Bench Logic Sniffer to obtain preliminary addressing information, then used an nRF24L01+ module in receive mode to capture packets. […]
Video: JTAGulator introduction and demonstration
Hardware hacking guru Joe Grand of GrandIdeastudio has posted this new, detailed introduction/demonstration of the JTAGulator, an open source hardware tool te hat assists in identifying on-chip debug (OCD) and/or programming connections from test points, vias, or component pads on a target device. (We note the Bus Pirate usage at 5:40.)