PCB (and Schematic) reverse engineering

[jpyeron]

From time to time I have a PCB and I need to fix it or make changes, etc. Some of these times I go full reverse engineer.

Today is one of those days, but I decided to make my life easier (and share). I am patching KiCad, this is the punch list I started with:

Priority   Change
1   Quiet PCB/schematic sync (done)
2   Ctrl+Alt route-and-join
3   Automatic current-net labels
4   1–4 point image registration + disk cache (done)
5   Schematic ratsnest reusing PCB implementation
6   Selected-trace width stepping (done)

Searching here, I see:

• https://www.eevblog.com/forum/eda/simple-schematic-from-nodes-file/msg3558424/#msg3558424
• https://www.eevblog.com/forum/eda/magazine-artworks-to-gerbercopper-layer-conversion/msg3661846/#msg3661846
• https://www.eevblog.com/forum/eda/netlist-to-shematic/msg5231919/#msg5231919
• https://www.eevblog.com/forum/eda/issues-with-imported-copper-pour-in-sprint-layout/msg6241681/#msg6241681
• https://www.eevblog.com/forum/eda/how-do-i-determine-footprint-sizes-for-surface-mount-components/msg960066/#msg960066
• https://www.eevblog.com/forum/eda/pcb-re-tools-techniques/msg1390241/#msg1390241

So here is the question - what is on your wish list to make a better reverse engineering environment?

[jheissjr]

Kicad is missing a feature to resize jpegs with dimensions. PCB images are used for reverse engineering and images are resized to the dimensions of the PCB. Two points are selected in the image, the user tells Kicad the distance and Kicad enlarges or shrinks the image. One resize for horizontal and one for vertical. Kicad is missing the feature. Solidworks has the feature at t=28seconds.

[jpyeron]

Kicad is missing a feature to resize jpegs with dimensions. PCB images are used for reverse engineering and images are resized to the dimensions of the PCB. Two points are selected in the image, the user tells Kicad the distance and Kicad enlarges or shrinks the image. One resize for horizontal and one for vertical. Kicad is missing the feature.

Like this:

I added 1,2,3, and 4 point image adjustments. It does not do flipping, that should be done first.

The scale bar is cute, and has utility - but clicking points was much less change to the kicad UI.

I had a rectangular PCB, so I could draw a box of the dimensions, easy.

Otherwise I would make 2 triangles of 4 furthest calibration points. Ideally you would also have a horizontal or vertical reference. Layout (e.g. measure D1, D2, D3, D4, we already know the DIP package size) those 4 points then register the image to them.

[jheissjr]

That's the feature! The image transparency in the demo video is adjustable. The setting is in the right pane. Can you demo the features when your finished?

[jpyeron]

Ok, alpha channel - added to list


Re "demo" , have to, as part of the pull request.

[jheissjr]

Camera pictures are sometimes bowed at the perimeter. A feature to push and pull an image at the perimeter would be a nice feature. JPEGs on separate layers and that overlap can be adjusted together by stretching an image on one layer stretches and an image on a second layer stretches with it.

[Doctorandus_P]

Just yesterday I did Gimp / Tools / Transform Tools / Perspective for preparing to reverse engineering a PCB. With it you can grab any corner and drag it around and it works "instantly". ( 10 t0 30 fps or so, it's too quick to notice. I don't know why your algorithm is so extremely slow, but it's nice to have it for KiCad. My Gimp skills are very near zero.

In KiCad, I notice I'm switching between selecting an background image and unselecting it a lot. Especially when you are further in the process. an "unselcted image" get covered by tracks a lot, while when you select it, it's pulled to the foreground. It's clear, but you can't see the tracks. Alfa channel would help here.

Also, when the background image for the front is selected and you go to the back with [PgDn], it would be nice if this switches to selecting the background image for the back layer.

In KiCad you can draw tracks between uncommitted footprins (I.e. footprint pads not in the netlist from the schematic) but normally KiCad prevents you from connecting to pads that are not in the netlist. That is good of course, but during reverse engineering you want a quick method to override it.

Because that is not available in KiCad, I turned my method around. I first drew all symbols on the schematic. Added footprints and ported them to the PCB. Then I placed the footprints, but I also placed the symbols in the schematic same order as the footprints on the PCB. This makes it easy to sort out what belongs where. This works quite good.

And then you recognize circuit sections. A voltage regulator, an H-bridge, standard application note around an IC and such. So then I grabbed such an IC, put it in some empty area (usually outside the paper boundary, that is just a (very minor) nuisance.  And then I start building up the schematic first (which is needed anyway to get a neat schematic. Doing the PCB first, pushing labels back is not easier). Once I have a schematic section, laying the tracks in the PCB is easy, and it's an extra verification step. With this method, I did not have much need for pushing netlist connections from the PCB back to the schematic.

Rontgen view to look under IC's would be nice, but I guess you can't do that in software. Also this still does not help to look under aluminimum heatsinks. Maybe with a selective frequency, you could make aluminum transparent, but not copper. But that probably remains a wishlist item.

I had to make a few custom footprints. One for a weird fuse holder, and one for a transformer. You can also add a reference image in the footprint editor, but you have to calibrate it again. It would be nice if the calibrated image could also be imported in the footprint editor.

Now I had the footprint and PCB editors open at the same time. I guessed pad locations in the footprint editor, saved it and updated the footprint on the PCB. It works, but could be improved.

Writing this, I remember: PCB Editor / Preferences / Preferences / PCB Editor / Editing Options / Allow free pads I never understood the use of this, but now I suddenly realize you can:

• Create a footprint with the right amount of pads.
• Put it on the PCB
• Drag the pads around to put them on the image.
• Load this modified footprint into the footprint editor
• Do further cleanup, silkscreen, courtyard etc.
• Overwrite the old library footprint.
• Update the PCB with the new footprint to keep it all in sync.

I also discovered just now that it's already possible to change pad properties (hole, shape, etc) directly in the PCB editor. (KiCad is improving faster than I can keep up with, each new mayor version has around 50 new features). I guess that in due time, saving a modified footprint from the PCB directly to a library will be implemented. For now, you have to use the footprint editor as an intermediary step.

It would be nice if the Allow free pads is a footprint property instead of a global setting. Limiting it's scope prevents unintended changes to other footprints. This would also be nice for wire bridges, which can have a different size. This may be worth a feature request on gitlab.

Some people completely depopulate a PCB, sand off the solder mask to get a high contrast (and even mill of the PCB in thin layers to expose inner layers). Bitmap to vector conversion to automatically create PCB tracks would be very nice here.

In the default libraries many RefDes's are outside of the footprint courtyard. If you have for example a row of resistors, it's easy to mistake a RefDes with the wrong resistor (the guide line appears when it's selected). A quick way to move all RefDes's to the center of the footprint may be a good idea. It's not where you want it finally, (as they would be obscured by the footprints themselves), but normally you have to move them all anyway, so the initial position does not matter much.

Overall, the project I did yesterday (for around 80%) went quite smoothly. There is still one problem section. It's obscured by an overhanging heatsink. Nothing can be seen on the front photo. Back still has pads and tracks. Some BJT's (13003) look off. the circuit does not make sense with the datasheet pin ordering. I was also getting tired and too confused so I stopped.

[jpyeron]

In KiCad you can draw tracks between uncommitted footprins (I.e. footprint pads not in the netlist from the schematic) but normally KiCad prevents you from connecting to pads that are not in the netlist. That is good of course, but during reverse engineering you want a quick method to override it.

Because that is not available in KiCad, I turned my method around. I first drew all symbols on the schematic. Added footprints and ported them to the PCB. Then I placed the footprints, but I also placed the symbols in the schematic same order as the footprints on the PCB. This makes it easy to sort out what belongs where. This works quite good.

That is #2 on my list.

I had to make a few custom footprints. One for a weird fuse holder, and one for a transformer. You can also add a reference image in the footprint editor, but you have to calibrate it again. It would be nice if the calibrated image could also be imported in the footprint editor. Now I had the footprint and PCB editors open at the same time. I guessed pad locations in the footprint editor, saved it and updated the footprint on the PCB. It works, but could be improved.

...

In the default libraries many RefDes's are outside of the footprint courtyard. If you have for example a row of resistors, it's easy to mistake a RefDes with the wrong resistor (the guide line appears when it's selected). A quick way to move all RefDes's to the center of the footprint may be a good idea. It's not where you want it finally, (as they would be obscured by the footprints themselves), but normally you have to move them all anyway, so the initial position does not matter much.

Interesting.

[OneSmallStep]

PCBTracer is specifically designed to aid in PCB reverse engineering, troubleshooting and repair. The home page at pcbtracer.com describes its many features. It runs in the browser, is easy to use, and is becoming quite popular globally. 

[jheissjr]

You can also add a reference image in the footprint editor, but you have to calibrate it again.

switching between selecting an background image and unselecting it a lot

Place the mouse over the pad in the JPEG, hit the space bar, then place the mouse over the second pad. The distance between the pads is displayed in the bottom status bar as ΔX.

Change the image to locked and it will stop hiding tracks.

[Doctorandus_P]

The next KiCad version is already going to get transparency for background images. See:

 https://forum.kicad.info/t/post-v10-new-features-and-development-news/66611/35
(Note that it's a tradition to have a "Post Vx" thread for each mayor KiCad version on the user forum. All significant new features are announced there, so you have an instant overview of each version).


For your number 2:

What about [Alt + X] for routing with "connect to pad". Seems a nice shortcut, as [X] is already used for normal routing, and the keys are very close together, so you can toggle quickly between [Alt + X] and [X] routing.

[zzattack]

For me the number one annoying thing is joining two nets properly. If I find during tracing a signal from both ends that they're actually connected, what's the proper way to get these onto a single net? Ideally one does this mainly from the board editor, not by fixing up the sch and then synching it back up.

[jpyeron]

For me the number one annoying thing is joining two nets properly. If I find during tracing a signal from both ends that they're actually connected, what's the proper way to get these onto a single net? Ideally one does this mainly from the board editor, not by fixing up the sch and then synching it back up.

That is my #2 - if you have thoughts, I would like to hear, like Doctorandus_P:

...For your number 2:

What about [Alt + X] for routing with "connect to pad". Seems a nice shortcut, as [X] is already used for normal routing, and the keys are very close together, so you can toggle quickly between [Alt + X] and [X] routing.

In my mind, when I route if it is acting like a bumper car, but I want to join - I push the "meta" key and it will reconcile the 2 net names and join it - then synch will back port to the schematic. That sync process brings me to #5 - rats nest for the schematic editor.

[Doctorandus_P]

Pushing the netlist back is already possible, but it "just" creates labels directly on pins. Ratsnest lines in the schematic are an important puzzle piece that makes creating the nets in the PCB editor actually useful.

Maybe I missed it but what is the form of the end goal? Have you forked KiCad? Is it intended to be merged back into KiCad itself?

Many years ago there was a huge merge request dumped on the lap of the KiCad developers from an unknown developer. That was rejected back then, and partly simply because lack of trust. And the KiCad developers group already had their own ideas of how to improve the library system.

This will be useful to the most people if it gets merged into KiCad itself (I guess it can't be done as a plugin) But to keep the main KiCad branch in good shape, it has to fit well with the rest of the code. When a project gets as big as KiCad, working with some quality standards becomes mandatory. I'm not a developer myself. But I have made a bunch of bug reports and feature requests on github. It's probably a good idea for you to open an account on gitlab and tell the KiCad developers what you are working on. You may even get some help that way.

[jpyeron]

It intended to be merged back into KiCad itself.

Right now it is a hot mess of code - that is I have not optimized and or review too much agentic code. As soon as it parts pass my standards I will push to a public repo.

Side note: While developing I hit many assertion checks - each one stops me thinking its my code, alas none have actually been my code.

[Doctorandus_P]

It intended to be merged back into KiCad itself.

Right now it is a hot mess of code - that is I have not optimized and or review too much agentic code. As soon as it parts pass my standards I will push to a public repo.

Side note: While developing I hit many assertion checks - each one stops me thinking its my code, alas none have actually been my code.

In that case, communicate with the KiCad developers early. They can probably help. Some of your ideas are possibly never going to make it into KiCad (I'm not sure about the "quiet sync") myself, but it could at least be an option. They may have good ideas to make it easier to merge your code later. Code has to match with their direction of KiCad, or it will never be merged.

I quite often see loners working on their own greatest pet project, and that is swell. But KiCad is too big for that. For further growth, cooperation is a necessity.

[jpyeron]

the issues tracker is where I have been posting issue/fixes - but the lag there is so slow.

I just introduced myself on the mailing list, but not much seems to actually happen there.

Thanks for the suggestion.

[jheissjr]

A feature idea for labels is a menu option to locate labels and center the label on screen like Ctrl-F.

1. Select the top label "Enable".
2. Press N for next and the screen centers on the bottom label.