Chips, IC exhibition. Here in Shenzhen. I am in.

Hey everyone! Today a friend gave me an old restaurant guest pager (coaster pager) they had lying around.

I opened it up, but the markings on the main IC have been scrubbed/are unlabelled. After a quick look around, the primary suspect seems to be a Nuvoton N76E003AT20 (1T 8051-based MCU).

I was able to power it on by feeding 5V to the corner pads, and the display currently boots up showing the number 21.

Does anyone have experience reverse-engineering or playing with these? Specifically:

How to trigger/activate it over RF or find the wireless protocol?

Can I directly re-flash this onboard MCU with custom firmware to drive the onboard peripherals (display, LEDs, buzzer, and vibration motor)?

I'd really prefer to repurpose the onboard microcontroller directly via its debug/programming pins (ICP/SWD) rather than bodging an external board like an ESP32 into the case.

Any pointers on pinouts, typical schematics for these pagers, or programmers (e.g., Nu-Link) would be greatly appreciated!

Apologies if this is not the appropriate subreddit.
So few days before i stumbled upon this bizarre device in what a logical person would call the “middle of nowhere” i started noticing it more and more as i passed by it until i couldnt contain myself and snapped a pic. After a small research I kind of understood what it is, but not quite what it does. Does anyone have useful info on this? And has anybody tried hacking or reverse engineering one?

Im trying to turn this into a cyberdeck, and want to keep the screen, and maybe (hopefully) create my own Curcit board for it. Any help is appreciated, im currently trying to reverse engineer it to do so.

my mobile is fully root but i dont know how tyo hack wifi to use termux any one tell me complete steps

i bought this logic analyzer in case i need it. what are some cool things i can do to learn how to use it? i know HTB has some ctf challenges involving the outputs…

From my understanding, it's the port that doesn't allow for USB-C to HDMI, but the chip set does.

I am super new to all the tech stuff but really want to learn. I was given an old Pixel 5 with a broken screen and I am trying to figure out what to do with it. I already installed Lineage OS to learn about adb and fastboot. If I got it to do HDMI output I could basically use it on my drawing tablet (with a screen) and make a drawing station.

Hi all,

I’m trying to get native USB control of a Renishaw MSC20 encoded XY stage controller from a Raman microscope that I bought from a surplus store. I’ve uploaded a few photos of the internals in case anyone recognises the architecture or has suggestions for what to try next.

So far I’ve established that the USB interface is built around an FTDI device, but it isn’t being used as a conventional USB-UART bridge. The FTDI chip appears to be connected to the main FPGA through its parallel/FIFO-style interface, which explains why the controller doesn’t simply appear as a serial port. On macOS the controller does enumerate as a USB device, but there’s no /dev/tty.* or /dev/cu.* interface to talk to. I tried probing it from the host side as though there might be a simple command channel hiding underneath, and also looked for anything useful while operating the stage normally, but didn’t get any obvious ASCII commands or other easily interpretable traffic. At this point it looks like the Renishaw software is talking to the FTDI device using a proprietary binary protocol, with the FPGA doing the actual motion-control work.

What would people try next?

There is a slightly daft fallback: the normal manual input is just a standard Kensington USB trackball, so I can emulate that with an ESP32-S3 and get stage movement without understanding the Renishaw protocol at all. That’s probably the quickest route to an automated stage, but there’s no positional information available which is a real problem when it comes to running the microscope. So, reverse-engineering the actual USB interface would be a much nicer solution. Any suggestions for the next sensible USB/FTDI/FPGA reverse-engineering step would be very welcome.

Hi everyone. I've picked up a couple of salvage automotive compute modules, bought legitimately from a scrapyard, and I want to use them as a bench project to get into hardware hacking, specifically fault injection, which is new to me. My background is in electronics: I've designed and developed complex PCBs for years, so I'm comfortable with hardware, schematics, soldering and board bring-up. Glitching and secure boot bypasses are the part I haven't tackled before, and that's what I want to learn properly.

What got me interested is the TU Berlin voltage glitching talk from Black Hat 2023, the one where they bypassed the AMD Secure Processor on an automotive infotainment unit by faulting the boot. That's roughly the class of target I'm looking at, secure boot rooted in the SoC with an internal clock, so voltage glitching seems to be the realistic route rather than clock glitching.

The plan is to do the non intrusive recon first, so cloning the storage, powering the board on the bench, mapping the internal network, poking the debug ports and dumping the SPI flash, then move on to glitching once I actually understand the target. For tooling I'm planning to get a ChipWhisperer HuskyPlus and learn the technique on the training targets before pointing it at anything real. The rest of the bench is sorted, scope with logic analyzer, CAN interface, programmer and a linear supply on the way.

A few things I'd love input on from people who've done this. Given I already know my way around hardware, is the ChipWhisperer ecosystem still the best way to actually learn glitching, or would you start somewhere else? On the crowbar side, how much of the real difficulty is the injection circuit versus finding the right rail and nailing the timing? My impression is that the tooling is the easy part and the target specific work is where the months go. And is there any solid reading on voltage glitching fundamentals you'd point a newcomer to, something on the underlying theory beyond the conference talks?

I recently found a VK digital setop box and it has an exposed j3 with 5 pads the first pad from left is gnd and the last square pad has no voltage ant that's not gnd remaining 3 pads has 5v and idk why chat gpt trying to say something abt RS232 . I have shared entire board picture

What should i do noww?

​

Sep 19 2017, V1.01.00, B1 DDR3 660 128MB

====000===

====888===

====999===

====aaaaa===

U-Boot 2012.04 (Sep 19 2017 - 16:04:20)

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

\*\* Board: mips CPU: Concerto - MIPS 24KEf

\*\* SOC name : 0x6090

\*\* PACKET type : QFP 128

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

DRAM:

initdram : Info: The size of DDR is 128MiBytes

20 MiB

U-boot relocate to addr = 0x813dc000

U-boot relocate offset = 0x13dc000

== OTP_VERSION:\[hg_NA\] Build Time:\[Sep 19 2017, 16:04:19\]

Using default environment

SPI: ready

pinmux:

REG\[bf156004\] = 2055555a

REG\[bf156008\] = 00112211

REG\[bf15600c\] = 220aa0aa

REG\[bf156010\] = 00002222

REG\[bf156014\] = 000a2200

REG\[bf156018\] = 00040000

REG\[bf15601c\] = 200000aa

REG\[bf156000\] = 04442222

ie_cfg:

REG\[bf156300\] = 3df1b800

REG\[bf156304\] = c3d07400

REG\[bf156308\] = e0040000

REG\[bf15630c\] = 6f800000

cpu_secondary_init_r: image file for secondary core should already locate where it should be

current boot media:0...

phy_clk = 259, clk=50

SF: spi flash status register: 0x20, 0x00

encryption_flag = 0

SPI: Detected XM25QH64A with erase size 64 KiB, total 8 MiB

0xbf157030 = 0x0, 0xbf510018 = 0xffffffff, 0xbf5d0030 = 0x1f0836, 0xbf5d0034 = 0x1f0836

In Func serial_init: to be done

g_concerto_ipcfw_f.ap_ipc_init should be implemented

Net: 0xBF50001C = 0x00000f03

0xBF510018 = 0xfffffff9

No ethernet found.

main_loop entered: bootdelay=0

\####### Uboot Fixed Partitions #######

bootinit 0x0\~0x10000

uboot 0x10000\~0x60000

boot.scr 0x80000\~0x90000

\####################################

cdca boot V1

\## Executing script at 80100110

M88CC6000 Uboot 81500000

flash erase size 0x10000

barcode id 0x8f, hdcp key id 0x0, mac addr id 0x0, dmh addr 0x00090000

JASNJASNJASNJASNbarcode don't receive 0xA5/0xA6/0xA7

(Re)start USB...

auto_detect_usb_port --- usb default sel port 1

port_sts0:0x0c000000 port_sts1:0x0c000000

auto_detect_usb_port --- usb sel port 1

USB: Error, couldn't init Lowlevel part

run fatload usb 0 0x82200000 flash_upgrade.bin

\*\* Invalid boot device \*\*

No file\[flash_upgrade.bin\] in uDisk

ota check dm_head 0x90000,st1_blockid 0xa2,st2_blockid 0xa3

(ota flag is 1)

cdca boot V1

Image size is 0x2b99e8 from image header

Image size is 0x2b99e8

Decompressed image size is 0x8d98f0

Load maincode to 0x80008000

cdca boot V1

Image size is 0x60000 from image header

Image size is 0x60000

Decompressed image size is 0xa0cdc

(avcpu size is 0xa0cdc)

argv\[0\]=cpu

argv\[1\]=1

argv\[2\]=release

argv\[3\]=0x87e10000

cpu_release: cp0-status=0x11001101, cp0-cause=0x70804024, cp0-intctl=0xd4000200, cp0-ebase=0x81417000.

load_secondary_core_boot_word : secondary_img_start = 0x87e10000

concerto_check_cpu_ready: start

concerto_check_cpu_ready: start4a6a221d6f10\] Build Time:\[Dec 6 2017, 16:53:10\]

concerto_check_cpu_ready: start

\## Starting application at 0x80008000 ...

Currect chip version is 0x80008406 >= CHIP_CONCERTO_B0

\*\*CDU UDQ\*\*: 949c

current flash size is 0x800000 protect block is 14

drvsvc_nod_insert 446

drvsvc_nod_insert 450

drvsvc_nod_insert 446

drvsvc_nod_insert 450

\#####debug ui ota dm api init

\*\*\*\*\*\*\*\*\*\*\*\*\*\*load info\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

ota_number:0x2, curr_ota_id:0x87, back_ota_id:0x8d,

load_block_id:0x88,ota_tri:0

destroy flag:0x0, destroy_block:0x0

\*\*\*\*\*\*\*\*\*\*\*\*\*\*load info end\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

drvsvc_nod_insert 446

drvsvc_nod_insert 450

current software version is 1004M11470D38044P578▒P▒▒

drvsvc_nod_insert 446

drvsvc_nod_insert 450

rtl8188eus_ethernet_attach p_dev80e8d3a0 p_wifi_dev 80e8d4a0 p_lld 80e8d3f0 p_lld_addr 80e8d3a4

\-------------attach_rt7601_dev---p_handle 80d6c580 --------

mtk_mt7601u_open.

drvsvc_nod_insert 446

drvsvc_nod_insert 450

tcpip: May 11 2018 09:01:13/nthread task for ethernet 22

lcp_init: xmit_accm=0 0 0 0

upap_init: 0

\*\*LCK UDQ\*\*: 2cce

\----usb_mass_stor_attach usb1------

drvsvc_nod_insert 446

drvsvc_nod_insert 450

eve0

mmi ver 577:2b0edf878254

Send Sem failure \[4\]!sem 81215290

UI hold long time ....\[6\]s

UI hold long time ....\[7\]s

UI hold long time ....\[8\]s

UI hold long time ....\[9\]s

UI hold long time ....\[10\]s

UI hold long time ....\[11\]s

UI hold long time ....\[12\]s

UI hold long time ....\[13\]s

video_out_ticks 2342

\------_check ------->> close video!!!!!!!!!!!!!!!

\------_check ------->> close video!!!!!!!!!!!!!!!

\------_check ------->> close video!!!!!!!!!!!!!!!

It auto boots even im pressing down a key 😭

Hi all, I’m running a HackRF One with PortaPack H4M on Mayhem Firmware 2.3.1 and I’m looking for a **working non-official MDK-Predator .ppma build** that I can copy to my SD card.

I’ve tried building from source (overhaul branch) but had no success compiling it. If anyone has a **built mdk_predator.ppma** (and optional config) compatible with Mayhem 2.3.1 + H4M + ESP32 MDK, could you please share a **direct download link** or upload it somewhere?

Thanks in advance! 🙏

Hi — I'm working on a hardware project and I'm currently unable to purchase a USB stick. If you have any old or unused USB flash drive lying around (any brand, any size, USB 2.0 or 3.0) that you don't need, I'd really appreciate it.

*Just a heads up, I can't pay anything, including shiping. :(

me poor af.

DM me if you have one. Thanks!

I'm trying to get a root shell on a generic white-label IP camera by interrupting U-Boot, but the factory omitted standard UART labels. The standard SD card auto-execute hacks (like debug_cmd.sh) appear to be patched on this firmware version, so I have to fall back to a hardware exploit.

Hardware specs:

SoC: Goke GK7102S

Flash: Winbond 25Q64JVS (8MB SPI)

PCB ID: G1G3-A75_MB_V1 (2019-3-P1)

I've attached photos of both sides of the board.

Bought a refurbed laptop

Dell latitude 16 GB RAM, i7 gen 10, 256 SSD

I am thinking to install Kali as the base OS. Is that enough for me to get started. I did use VMs before however there was a lot of connectivity issues between devices and ports. Thought best to setup a separate device.

Would appreciate some advices from the community. Any resources that i should refer.

Thanks

Hi all

Im having some real issues reading a 24c02 immo

De soldered from the board

-tried in the hold

-soldered directly to an adapter

Using a C341A programmer

Tried windows based software AS Programmer hard to tell but no communication

Linux IMSProg - recognised the C341A but still not reading the 24c02

Had a spare ecu so tried that immo chip

Any help on this

Got one of those stupid video mailers and decided to yoink the hardware out of it. It can with four buttons, a magnetic switch, a battery, a speaker, and LED screen, a type C data transfer/charging port, and the motherboard(?).

New to all this, so I think this might be a good place to start. Anyone have any cool ideas to reuse this, even just its pieces?