PCB Reverse-Engineering

[Singapura]

@Aurora

Thanks for your encouraging words and recommendations. It warms my heart to know there are like-minded engineers who appreciate and support my hard work. Knowing you through this forum has been one of the most rewarding find since writing my book.

It's unlikely that I will go the ebook approach. There's already a link online that presumably states my book is available for download but when I clicked on it to check it out, it's just another gimmick to obtain personal data and email and requires you to pay for subscription to their download services, without the assurance that the book is really there for the take. Why anyone would go through the trouble, take personal risk and get spammed in his or her email, instead of just spending straight money to buy a book from a trusted source with peace of mind, is beyond me.

And as I mentioned in the About the Author page of my book, if this first venture into book writing is sustainable, I will consider writing more books to share my experience in other areas, such as test program development, PCB troubleshooting, and even writing technical documentation (which I've learned through documenting Thales' mine hunting system on the Organization, Intermediate and Depot levels). Otherwise, I'll have to drop the idea and move on to other more worthwhile things.

But it's a pleasure to have known you, Fraser. It certainly is. 

Singapura

[Galenbo]

... The FP machine alone is costly (>$100K) and one that can do probing on both sides will be even costlier; the RE software is usually opitional and not included with the basic package.

I've visited a company that sells very high resolution flatbed scanner for RE purposes. Their approach is to sacrifice a PCB using a meticulous process, peeling off layer by layer and scanning each layer, then superimpose the scan images and feed to their software to re-construct the board's gerber data.
...

So after all, it is done with "some pictures" as I taught. :-)
Thanks for all the detailed info.

[Singapura]

@Galenbo

The scan image approach is by no means easy as the PCB has to be stripped bare of all components first, and if it is a multi-layer board, it must be sacrificed i.e. peel off layer-by-layer carefully, a task that requires skill and steady hands, especially if the board is very dense and contains many hidden or buried vias, which is quite a challenge in itself. Tell me if any customer is prepared to let you do that to their last piece of spare PCB!

From what I gather from the company, they only produce the gerber files in order to facilitate re-production of the bare board. To re-construct the schematic diagram involves another tedious task of identifying and assigning the various component footprints to the gerber data in a CAD-CAM software like CAMtastic, then converting and importing it to the PCB layout design file format of a target CAE tool such as Altium Designer, cross-referencing the parts to Altium's schematic library symbols (ICs with multi-parts can be tricky), before you can back-annotate to create the draft schematic of the PCB.

It may sound simple but actually quite a number of processes are involved after importing the gerber and NC drill data, such as layer type assignments, board stack-up and drill sets, netlist extraction (the success of this step depends on the accuracy of the preceding steps mentioned), handling split plane sections (if nested planes are present, your CAE software may not even support it!), etc. Even when the draft schematic is generated, you still need to do a physical electrical connectivity check with another good PCB to verify the accuracy.

So besides the learning curve involved in using the CAE software, you need to have a good understanding of PCB structural designs to carry out the steps outlined above. There is no quick fix like an automated one-click solution that converts gerber data straight to schematic solution. Even for a simple double-sided PCB, I find that doing the manual way is still the fail-safe and most effective approach.

Singapura

[briselec]

I recently had to reverse engineer the operator console in the attached photo so I could connect a new system to it. Try sticking that in your scanner.
I started by tracing out the simpler sections and drawing it out in gschem. Once I knew the address, data and control bits and had some idea how they were used I connected a beagle bone black and ran test code to work out the finer details. You can't see them in the photo but there are a number of CPLDs so tracing connections would have only got me so far.

[Fraser]

@briselec,

Nice work 

You have highlighted my main weakness when reverse engineering a PCB. I am not a skilled coder so when I see a CPLD or FPGA chip I have to treat it like a block that takes data in and produces data out. I can often work out what the in and out data is for but as to what happens inside the chip.....that is lost to me. CPLD or FPGA combined with BGA format are the stuff of nightmares fro me and so modern electronics is becoming harder and harder to fully reverse engineer. This is how the manufacturers like the situation of course as they are keen to protect their IPA and make non official repair or adaption difficult.

With computers on a chip these days, there is often little to be learnt from the PCB. The clever stuff is the firmware /OS and any on chip DSP. As these mat be protected behind ASIC fire walls there is little that can be learnt about their internal configuration  PCB reverse engineering may be a dying art due to the advances in technology and greater integration of chips but thankfully there is plenty of need for it at the moment as the equipment needing repair is often more than a decade old 

Like in the world of Software Designed radio, it seems to me that many modern electronics solutions are becoming more and more software defined and less and less based on many discrete IC blocks as was traditional.

Aurora

[fugro]

Aurora
I have spent a couple of hours this afternoon reading with interest your history of reverse engineering and being suitably impressed.  Earlier today I posted a question about a PM675 on another section of the forum, but which was specifically addressed to you.  Unfortunately I am not equipped at home to follow up your extremely interesting studies on RE and do not have the time or resources to do this at work either.  The PM675 is part of my firms investigative equipment and went faulty about a year ago. That was when I was first introduced to the EEVBlog and I believe we had some communications on the subject. Due to pressure of work I had to relegate the camera to our repair shelves and it is only now, when I found myself free of work pressure, did I dig it out  to have another try at resolving the problem.
Having reached a point of frustration, I searched around on the forum and came across the conversations on RE and was so interested that I am afraid I have neglected some of the other work I should have been doing today.
 If you ever get around to taking up thermal camera repairs, as you suggested you might, let me know and I will let you have a stab at our PM675. Having successfully followed the tear down procedures and checked what I could with a DMM and an analogue scope, I have decided to reassemble it and return it to it the shelf where it has rested for the past year. 
 I don't know in which part of the UK you reside, but I am probably not too far from you and, as you have resolved the circuitry of everything in the camera, it would be a doddle for you to repair it.
 

[dds737]

Can somebody shed more light on these two RE tools:

[1]https://www.eevblog.com/forum/eda/chinese-made-quickpcb2005-software/msg582651/#msg582651

[2]https://github.com/unixdj/depcb

[amirtebyan]

Hi everyone
I'm working on a multi layer pcb ( 6 layer in this case). I used imaging method using medical CT and CBCT to discover pcb inner layers. The problem is that after reconstruction CT data the tracks of inner layer are not clear and Recognizable. Can anyone help me what point is missing?

Sent from my SM-N920C using Tapatalk

[Singapura]

Hi Fraser and friends

It's been a long time since I re-visited this post. Just to notify you that I've just completed collating and editing an eBook containing various integrated circuit packages and their dimensions which you can reference to create your own Visio layout drawings. There are a total of 109 different drawings, ranging from the standard DIP, SOJ, SOP, SSOP, TSOP to the BGA, uBGA, QFP, LQFP and PLCC, etc.

Please go to my website where you can download it. Of course, you need the password from my book to unlock and unzip.

http://www.visio-for-engineers.com/downloads.html

Have a great week! 

Ps: For those of you who've given reviews for my book, kindly email me to claim the extra goodies which I've announced at:

http://www.visio-for-engineers.com/blog/rewards-for-reviews
http://www.visio-for-engineers.com/blog/additional-rewards

My email can be found in my book on page xii.

Cheers! 

[Fraser]

Hiya,

Great to hear from you again  I hope all is well with you and yours. Thank you for releasing yet more helpful material to us.

I am back to repairing thermal cameras since my health returned to relatively normal. I have had to reverse engineer several parts of PCB's as no schematics are available to the public. Having even just a block diagram of an equipment really helps when tracking down the cause of a fault.

I need to practice with Visio though as I an still using a pencil and paper for speed. I have installed a Dell 'All in One' PC at the rear of my lab bench so that I can view schematics whilst working on equipment. Little steps at the moment while my health continues to improve.

I am finding that modern electronics is using more and more FPGA technology and this does make reverse engineering a challenge in terms of documenting useful detail. I have been working on a FLIR TAU thermal camera and the chip count is very low thanks to an FPGA. Sadly that means much of the workings of the unit are buried inside a chunk of plastic and silicon. Progress !

Best wishes

Fraser

[Fraser]

The FLIR Tau thermal camera that I am working on consists of a microbolometer PCB that contains only voltage regulators and a main PCB that is mostly a FPGA and some memory chips ! Lots of 0402 discrete resistors and capacitors though !

The block diagram is somewhat simple !

Fraser

[Singapura]

Hi Fraser

Sorry to hear about your health issue. Hope you'll get better soon!
Glad to know that you're still doing reverse-engineering.

The board should be manageable if not for the BGA chip which can be quite a challenge...
Care to share how you derive the block diagram without the schematics?

[Fraser]

No problem.

With such a unit I research all of the IC's on the board to determine their needs and I/O ports. A thermal camera is basically a single board computer with ADC inputs and DAC outputs. The FPGA does the clever signal processing and has to be treated as a 'processing block' combined with a microprocessor to control the camera. As a SBC it will have the normal component parts. Namely :

Multiple Power Supply rail generation and regulation
Monitor IC controlling power on RESET and monitoring a supply rail
The 'microprocessor' (FPGA in the TAU)
ROM for the firmware and Calibration files
RAM for the OS to use

Plus the following application specific parts....

ADC for conversion of input to a format useable by the microprocessor
DAC for conversion of the data to a human friendly format.

Communications between the various IC's can be determined from the data sheets. Examples are serial or parallel data busses, Address busses, RESET and handshaking lines. The Block diagram for such a simple architecture is relatively easy to create without even tracing every interconnection. Logic dictates the topology.

The TAU uses an FPGA as its microprocessor, the ROM is an SPI Flash chip and the RAM is an SDRAM chip. The Reset management and power rail monitoring is carried out by a dedicated IC designed for such tasks. Power supply rails are derived from a single 5V source and are created using common Boost / Buck converters. Power rails are 1V2, 1V8, 2V5, 3V3, 3V6 and 12V0. The input ADC resides inside the microbolometer ROIC and sends parallel data to the microprocessor. The DAC is a VIdeo DAC IC designed to convert parallel digital data into a composite video image for a conventional TV monitor or EVF.

The data sheets for the chips tell you most of what you need to know about the various IC power supply and data needs. Sample circuits also show the likely design that has been employed in the product. The TAU uses the recommended circuits around the Boost / Buck converters and Video DAC stage.

The only real mystery is what is going on inside the FPGA. Fortunately I have worked on many thermal cameras that did not use such high integration so I know what the FPGA must achieve and the elements that must exist within it.

From a manufacturer point of view, the FPGA is an excellent way to make reverse engineering of a product harder in in order to reduce the chances of clones being produced.

Thermal cameras like the TAU are a hybrid device in that they use some basic hardware building blocks to capture and display the images, but it is the magic that occurs in the firmware that is really important. The software takes some pretty ugly image data and processes it to produce the nice clean images with which we are familiar.

Fraser

[Singapura]

Hi Fraser

Wow! Thank you for the clear and concise description of the process in creating the block diagram.

Though it looks straightforward enough to the casual reader, it comes with years of working on thermal cameras to be able to spell out the steps involved, like as it's a matter of fact.
Your experience and expertise shines through as a testimony to your labour and hard work in this endeavour, and I salute you for that!

By the way, please email me to get the Visio artwork for the power supply module (see attached figure) which I highlighted in the end of Chapter 3 of my book.
Hopefully it will enable you to learn more of the tricks in creating technical illustrations using Visio.

Cheers and to your full recovery in health!

[Iron Downey]

You can get Schematic and Gerber data from PCB Reverse-Engineering. If you want BOM as well, then you can do PCBA Reverse-Engineering. All you need to do is to send a sample of the PCB board or the PCBA board to the guy who can do the job for you. It's simple. More complicated the board is, more expensive.

[Jane]

Very interesting thread.
@Fraser:
As I can see you are a real expert in reverse engineering.
I have a device that also consists FPGA and that device can not boot up successfully.
When I check a log file I can see teh device  restarts because it can not initialize OLED LCD of that device.
The log says that FPGA can not initialize OLED. I used another OLED but the problem persists. Do you think that FPGA is faulty or just an IC around  failed to communicate with that FPGA?
 ( I think that FPGA is being flashed on a fly from a flash memory that is a part of that device.)
Do you have any hint how to try to repair the problem?
Thank you

[Singapura]

Hi Jane

Is the FPGA Altera or Xilinx type? Some FPGAs are pre-programmed (electrically erasable) and some are configured upon boot-up (RAM-based). If there is a configuration PROM near it, it's likely to be the latter.

While it's possible that the FPGA may have a bad logical cell array (LCA) that cause the failure, it is good to check the PROM content first to see if the config data is OK (that is, if you have a spare good one to compare, or the hex file).

If you have already eliminated the OLED LCD, and the PROM content is good, chances are the FPGA may be faulty.

[Jane]

Thank you for your reply.
Can you please be more specific what you mean by configuration PROM ?
Thank you

[helius]

For a FPGA to run the intended design, it has to be able to load the bit pattern called the configuration that sets it up for that design. Sometimes this configuration is stored in a Flash memory on the FPGA itself, but other parts have no non-volatile memory, and require the configuration to be reloaded each time the hardware is reset.
The chips with non-volatile configuration memory are mostly made by Microsemi (formerly Actel). Lattice also has some non-volatile chips. The chips that require external configuration rom are made by Xilinx or Altera. Typically they use a special device called a 'Quad SPI' or QSPI flash that have distinctive part numbers.
http://www.xilinx.com/Attachment/QSPI_FLASH_support_guide_rev1.0.pdf

[Jane]

That FPGA is  Xilinx XC3S400A.
Is there any clue how to check if that FPGA is already programmed or is it done on a fly( during booting process) ? And then  can I simply replace that FPGA?( That is BGA type)
Thank you for your feedback

[helius]

XC3S400A is a Spartan 3A, and is volatile memory only. There is nothing stored inside when it is powered off, so it can be replaced.
The chip may have an underfill added during assembly, which increases the difficulty of removal.

[Jane]

@helius:Thank you for your reply. That FPGA XC3S400A (being rather hot) could be a culprit for the device not booting properly. But there can  also be a problem in a memory ( or its voltage) that provides data for that FPGA.
Do you have any idea how to start with that repair? Shall I replace that FPGA and check if that solve the problem? Or is there any smarter way?

[technotronix]

Can I see inner traces of boards with internal power and ground planes with x-ray techniques in reverse engineering?

[Fraser]

Simple answer is yes, providing you have a decent high resolution X-Ray machine and components do not obscure what you want to see.

Fraset

[Singapura]

Dear friends

This is just a notice to inform those who may have visited my website www.visio-for-engineers.com occasionally.
My lease with the web-hosting service will be due in about three months.
I'm not sure if I want to renew the lease after it expires.

So I decided to create a Facebook Page and try managing it for the moment.
You can find the link here: https://www.facebook.com/artofpcbreverseengineering/

Thanks for your kind support and understanding. Have a great day!

Cheers!