4 ms·
How to Reverse Engineer a 12 EUR Intel PCIe FPGA Card IBM 98Y2610
- lnsru 2y agoIt’s not that hard to reverse engineer anything you know about. You know, there is FPGA, there is PCIe, FPGA model is also known. All externals interfaces are also known. High probability, that the board is not broken. Imagine obscure motherboard, produced 25-30 years ago. No current colleague has seen it before. Half designed internally, other half circuits licensed. All the ICs met very aggressive thermal glue and their names are gone. The client is to ready to pay anything for the repair. They sent you crate full of broken boards. That’s where real reverse engineering starts.
- aebtebeten 2y agoreal reverse engineering: https://www.smbc-comics.com/comics/1717609925-20240605.png https://www.smbc-comics.com/comics/1717609925-20240605.png
- gsf_emergency 2y agoForsooth! the "reverse" in https://en.wikipedia.org/wiki/Reverse_mathematics https://en.wikipedia.org/wiki/Reverse_mathematics Has the same semantic value, that one may thus observe "Sufficiently advanced mathematics is indistinguishable from engineering" -not ACC [I'm distraught that WSmith didn't draw the symbol for "Eigen... F*ck you"] https://youtu.be/LUuogMZ0eP8 https://youtu.be/LUuogMZ0eP8 (Healthy Imbecilic Artificial Divinity (メイ))
- 082349872349872 2y ago「 強い、 強い、 だめ、 だめ！」 The more interesting parts of maths lie where one can reach (apparently) strong results from (apparently) weak premises: yield to the desire to start with too strong of an antecedent, and your poor technique kills your own sword/[proper frame hom into 2]: ex falso quodlibet. (look into your sword, Y. Gradstudent Sagiri: have you detached that head clause by cutting into a principal prime ideal and a completely prime filter?) see also https://news.ycombinator.com/item?id=42375498 https://news.ycombinator.com/item?id=42375498
- mikewarot 2y agoOr imagine a Drake R8A receiver, described as "guaranteed NOT to work" that a friend picked up. It can be tricked into working, but it gives a "PWRLOS" display most of the time, and there is no discernable cause. Thanks to the obscure NEC uPD78213 cpu actually being available and documented, and having no internal rom... it's time to write a disassembler[1] (or later find out that MAME has one[2] thats pretty good), look at all the schematics, and figure out how the firmware works. *Still working on the disassembler, because I can eventually make mine interactive, add labels, comments, etc. [1] https://github.com/mikewarot/Res78213 https://github.com/mikewarot/Res78213 [2] https://docs.mamedev.org/debugger/memory.html#debugger-command-dasm https://docs.mamedev.org/debugger/memory.html#debugger-comma...
- lnsru 2y agoOne must love Drake R8A receiver! I would say, that having no internal ROM is an advantage in this situation.
- jandrese 2y ago"No internal ROM" might mean that it relies on a bunch of custom PLA chips which would not be an improvement. With a ROM there is at least a chance you can dump it and run a disassembler on the contents to figure out what it is trying to do.
- lnsru 2y agoLooks like there is regular EPROM in this case. Nothing too ugly. Except very old microprocessor.
- mikewarot 2y agoNope, I've got complete schematics, and a dump of the EPROM. It's going to take a while to figure out how the heck why it's hallucinating a power failure (the signals going into the CPU are appropriate).
- 2y ago
- deleted 2y ago[deleted]
- buildbot 2y agoAny idea how much a service like that actually costs? Say I had an old camera, how much would reversed engineering the CCD drive circuit cost?
- lnsru 2y agoWhat’s your expectation from CCD drive circuit? Understand enough and repair it? Make a similar device? Make a micrometer exact clone? In that case with old crap we used X-ray pcb inspection machine. Made enough pictures to recreate all the copper traces on paper. Was enough to understand how it works and repair.
- tyingq 2y agoHe doesn't mention it's a RS485 I/O card meant to fit into an CEC expansion box in a Z14 mainframe. Might be helpful terms to search if you're looking to find very similar parts...since there might be run on this one specifically. Found part number 98Y6848 looking this way, which seems like an updated (or maybe just renumbered) version of this.
- trollbridge 2y agoRS-485 is pretty much the standard to communicate with SDLC to another device. Think of this board as a serial port for a mainframe. Looks like the same card is intended for use in IBM POWER hardware too, running OS/400 or AIX (or Linux). Of course, an open question is who on earth is still using SDLC over RS-485 these days, but then again I still see new Dell servers fitted with RS-232 ports.
- MisterTea 2y agoI hope serial never goes away. It's a time tested communications interface that is simple to implement and not a patent minefield.
- evoke4908 2y agoWe've been using RS232 since 1960. I have 100% confidence that in a thousand years there will still be engineering terminals in starships emulating a VT100
- Aloha 2y agoThere will at least - in 75 years be something internally, a minimum layer of abstraction that looks a whole lot like VT100 escape codes in a character stream. It's probably one of the stickiest API's that I can think of.
- numpad0 2y agoRS-232/422/485 are better than surprise USB-C port that require outdated specific Rust compilers and random 32bit ARM binary and an archive.org copy of random repository along cryptic code comments in it to make it work. Obsoleting RS-* ports could very well trigger that event.
- gbraad 2y agoIt sells on taobao for 300 CNY The updated board: 98Y6848 sells for about 240 CNY
- KeplerBoy 2y agoIf you want to tinker with PCIe FPGAs I would rather look into DMA Cards developed for PCIleech, Nitefury/Litefury boards or Alinx boards. All of these options can be had for ~100$.
- deivid 2y agobeen looking for something like this, thanks!
- Beijinger 2y agoLOL. What does it do? DMA Gladiator, FPGA DMA with Custom Unique PCILeech Firmware For cheating in games?
- KeplerBoy 2y agoYes, people use it for cheating in online games. PCIleech was originally a framework developed for general pentesting and redteaming. Under certain circumstances pcie devices have read and write access to the entirety of the RAM without any special software running on the connected PC. The pcie device can simply send packets requesting the contents of addresses and the bus happily responds. This enables all kinds of interesting things. Unfortunately games also store the position of enemy players in memory, so people use it to read those values from memory. But at least we got cheap fpga devices from that situation.
- anyfoo 2y agoIs that still the case? IOMMUs have been a thing for a very long time, and nowadays you don’t trust random devices anymore. Certainly a Thunderbolt port (which is PCIe-via-string) does not want to expose memory unrestricted, and while you might be tempted to think that a built-in PCIe card could be under more lax policy because it’s considered “physical access”, you don’t actually want the driver code for that card to be a wide open attack surface for the rest of the system.
- lmz 2y ago