4 ms·

How to Reverse Engineer a Schematic from a Circuit Board (2011)

53 points by jnord 6y ago

peter_d_sherman 6y ago
Great article! Related thought: Someone should reverse engineer schematics from all old legacy ISA PC Cards -- and place those schematics online -- to preserve that historical legacy into the future...
dang 6y ago
Discussed a bit in 2012: https://news.ycombinator.com/item?id=3503521 https://news.ycombinator.com/item?id=3503521
anonymousiam 6y ago
Did a lot of this when I was younger (and the PCB feature sizes were larger with fewer layers). One of my early triumphs was figuring out exactly where to drill in the blue brick to permanently enable subscription television service. Fun! https://en.wikipedia.org/wiki/ON_TV_(TV_network) https://en.wikipedia.org/wiki/ON_TV_(TV_network) https://en.wikipedia.org/wiki/SelecTV_(American_TV_channel) https://en.wikipedia.org/wiki/SelecTV_(American_TV_channel)
- knodi123 6y ago
  Brave man, confessing to your crimes juuuuuust after the statute of limitations runs out. /s
  - anonymousiam 6y ago
    LOL! I doubt that the statute of limitations for my (prior to DMCA) activities lasted anywhere near 40 years. Either way, I was a juvenile when I did these things.
- retSava 6y ago
  How did you do that, what was the signal you disabled?
  - anonymousiam 6y ago
    I somehow obtained an "ON TV" box. (From a friend of a friend who cancelled and never returned it.) I took a look at the innards and most of it looked a lot like a TV (RF front end, video demodulator, RF remodulator), Attached to the top (steel) cover was a module that was completely covered in blue potting material. I already knew about the scrambling techniques being used. (Sine wave mixed with video, but out of phase with horizontal sync pedestal. Sound encoded on narrow-band FM similar to SCA.) The blue module had only a few connections (from memory): 1) +12VDC and ground 2) Video input/output (via coax) from video demodulator. 3) Yellow wire which when driven with +12VDC, enabled FM demod of hidden sound channel. With nothing to lose, I took a blowtorch to the potted module. After about half an hour I had removed all of the potting (and many of the components). There was a large (40-pin) ASIC, a 14-pin (74xx TTL) chip, a few other chips, a row of drilled holes (24?) that coded the unique serial number of the box and fed it to the ASIC, and a one-transistor class-A inverting video amplifier/filter/mixer. The video amp had a bias input from the TTL chip (probably a 7400 configured as a S/R flip-flop). The ASIC had outputs to the yellow wire (sound) and to the 7400. It would receive coded instructions (sent to all boxes during the horizontal blanking interval) via the video input, but would only act on the "enable" or "disable" messages targeted to its serial number. Enable would set the flip-flop and disable would clear it. The bias from the 7400 flip-flop to the transistor came from pin 8 (NAND output). I deduced that the (destroyed) transistor had been NPN so I put in a 2N2222. I deduced the needed bias resistors and a DC-block capacitor and installed those too. I saw that when the NAND output was "low", it would bias the transistor to remove the sine wave from the video (by mixing it with an out-of-phase version provided by the ASIC). I was happy to find that my deductions were correct and that the (mostly destroyed) blue module actually worked well enough to decode the encrypted signals. I kept that box for myself and used it for years. When friends learned what I had done, they all wanted me to do the same thing to their boxes. I carefully measured the dimensions of blue module and the location of the 7400. By drilling into the lower part of the chip and shorting pin 7 (ground) to pin 8 (/enable) with a small blob of solder, the video decode would be enabled. Enabling sound was just a matter of cutting the yellow wire and connecting it to +12VDC. I got it all right on the first try and enabled many boxes for friends and acquaintances. It was my first real reverse-engineering/hardware hacking puzzle and I had a lot of fun doing it.
the_only_law 6y ago
I looked into doing this for a daughter board of a old ISDN terminal that utilized a strange, confusing, poor documented interface. After asking around, I was told I was mostly out of luck unless I was willing to destroy it because it was a 4 layer board. I still haven’t figured that damn thing out and will probably have to resort to even more tedious methods.
Animats 6y ago
Not only are there blind vias, some multilayer boards have capacitors in the middle of the stack.
- zbrozek 6y ago
  Buried capacitance is typically just a thin layer for improved sheet capacitance and used primarily for supply decoupling. As such, it's not really a relevant circuit element for reverse engineering. I've yet to see a consumer board with a buried resistance or capacitance layer. Nor have I seen discrete components somewhere in the laminate. Even things like rigid-flex or nonuniform laminate stacks across the PCB are extremely rare. Not even my cell phone has has such fanciness. Looking forward to tearing something apart that does, however!
- hulitu 6y ago
  Blind vias and components between layers are too expensive for consumer boards.
ivan1783 6y ago
If you have anything that's even a bit more complex (4 layer with a power and GND layer) this technique fails. However, pretty cool if you're working on 2 layer boards!
audiometry 6y ago
I want to make a schematic for a kbdfans keyboard. 2-layer pcb. Their tech support is negligible and their products aren’t very reliable. So my idea was to spend the money to get a schematic so at least I can debug them myself. Looked super tedious to do this myself and I have no experience anyway. So hired a guy on Upwork to do it. He ended up being a flake so I cancelled the contract. Reminds me that I should find another candidate.

53 points by jnord 6y ago

Great article! Related thought: Someone should reverse engineer schematics from all old legacy ISA PC Cards -- and place those schematics online -- to preserve that historical legacy into the future...

dang 6y ago

Discussed a bit in 2012: https://news.ycombinator.com/item?id=3503521 https://news.ycombinator.com/item?id=3503521

anonymousiam 6y ago

Did a lot of this when I was younger (and the PCB feature sizes were larger with fewer layers). One of my early triumphs was figuring out exactly where to drill in the blue brick to permanently enable subscription television service. Fun! https://en.wikipedia.org/wiki/ON_TV_(TV_network) https://en.wikipedia.org/wiki/ON_TV_(TV_network) https://en.wikipedia.org/wiki/SelecTV_(American_TV_channel) https://en.wikipedia.org/wiki/SelecTV_(American_TV_channel)

knodi123 6y ago
Brave man, confessing to your crimes juuuuuust after the statute of limitations runs out. /s
- anonymousiam 6y ago
  LOL! I doubt that the statute of limitations for my (prior to DMCA) activities lasted anywhere near 40 years. Either way, I was a juvenile when I did these things.
retSava 6y ago
How did you do that, what was the signal you disabled?
- anonymousiam 6y ago
  I somehow obtained an "ON TV" box. (From a friend of a friend who cancelled and never returned it.) I took a look at the innards and most of it looked a lot like a TV (RF front end, video demodulator, RF remodulator), Attached to the top (steel) cover was a module that was completely covered in blue potting material. I already knew about the scrambling techniques being used. (Sine wave mixed with video, but out of phase with horizontal sync pedestal. Sound encoded on narrow-band FM similar to SCA.) The blue module had only a few connections (from memory): 1) +12VDC and ground 2) Video input/output (via coax) from video demodulator. 3) Yellow wire which when driven with +12VDC, enabled FM demod of hidden sound channel. With nothing to lose, I took a blowtorch to the potted module. After about half an hour I had removed all of the potting (and many of the components). There was a large (40-pin) ASIC, a 14-pin (74xx TTL) chip, a few other chips, a row of drilled holes (24?) that coded the unique serial number of the box and fed it to the ASIC, and a one-transistor class-A inverting video amplifier/filter/mixer. The video amp had a bias input from the TTL chip (probably a 7400 configured as a S/R flip-flop). The ASIC had outputs to the yellow wire (sound) and to the 7400. It would receive coded instructions (sent to all boxes during the horizontal blanking interval) via the video input, but would only act on the "enable" or "disable" messages targeted to its serial number. Enable would set the flip-flop and disable would clear it. The bias from the 7400 flip-flop to the transistor came from pin 8 (NAND output). I deduced that the (destroyed) transistor had been NPN so I put in a 2N2222. I deduced the needed bias resistors and a DC-block capacitor and installed those too. I saw that when the NAND output was "low", it would bias the transistor to remove the sine wave from the video (by mixing it with an out-of-phase version provided by the ASIC). I was happy to find that my deductions were correct and that the (mostly destroyed) blue module actually worked well enough to decode the encrypted signals. I kept that box for myself and used it for years. When friends learned what I had done, they all wanted me to do the same thing to their boxes. I carefully measured the dimensions of blue module and the location of the 7400. By drilling into the lower part of the chip and shorting pin 7 (ground) to pin 8 (/enable) with a small blob of solder, the video decode would be enabled. Enabling sound was just a matter of cutting the yellow wire and connecting it to +12VDC. I got it all right on the first try and enabled many boxes for friends and acquaintances. It was my first real reverse-engineering/hardware hacking puzzle and I had a lot of fun doing it.

the_only_law 6y ago

I looked into doing this for a daughter board of a old ISDN terminal that utilized a strange, confusing, poor documented interface. After asking around, I was told I was mostly out of luck unless I was willing to destroy it because it was a 4 layer board. I still haven’t figured that damn thing out and will probably have to resort to even more tedious methods.

Animats 6y ago

Not only are there blind vias, some multilayer boards have capacitors in the middle of the stack.

zbrozek 6y ago
Buried capacitance is typically just a thin layer for improved sheet capacitance and used primarily for supply decoupling. As such, it's not really a relevant circuit element for reverse engineering. I've yet to see a consumer board with a buried resistance or capacitance layer. Nor have I seen discrete components somewhere in the laminate. Even things like rigid-flex or nonuniform laminate stacks across the PCB are extremely rare. Not even my cell phone has has such fanciness. Looking forward to tearing something apart that does, however!
hulitu 6y ago
Blind vias and components between layers are too expensive for consumer boards.

ivan1783 6y ago

If you have anything that's even a bit more complex (4 layer with a power and GND layer) this technique fails. However, pretty cool if you're working on 2 layer boards!

audiometry 6y ago

I want to make a schematic for a kbdfans keyboard. 2-layer pcb. Their tech support is negligible and their products aren’t very reliable. So my idea was to spend the money to get a schematic so at least I can debug them myself. Looked super tedious to do this myself and I have no experience anyway. So hired a guy on Upwork to do it. He ended up being a flake so I cancelled the contract. Reminds me that I should find another candidate.