PCB-RE: Real-World Examples

298 Pages·2019·23.491 MB·English

by  Keng Tiong Ng

Copyright © 2019 by Ng Keng Tiong. All rights reserved.

Cover design by the author.

Products and services mentioned in this book are trademarks or registered trademarks of their respective
companies. All trademarks and registered trademarks are the property of their respective holders.

No part of this book may be reproduced in any form, or stored in a database or retrieval system, or transmitted
or distributed in any form, by any means, electronic, mechanical, photocopying, recording, or otherwise,
without the prior written permission of the author.

LIMIT OF LIABILITY AND DISCLAIMER OF WARRANTY

The information, examples, illustrations, documentation, and other references in this book are provided "as
is", without warranty of any kind, expressed or implied, including without limitation any warranty concerning
the accuracy, adequacy, or completeness of the material or the results obtained from using the material.
Neither the publisher nor the author shall be responsible for any claims attributable to errors, omissions, or
other inaccuracies in the material in this book. In no event shall the publisher or author be liable for direct,
indirect, special, incidental, or consequential damages in connection with, or arising out of, the construction,
performance, or other use of the materials contained herein.

Print copy ISBN-13: 978-179-79-9995-1
In memory of my father…
a humble man who, despite his limited education, continued to upgrade
his knowledge by taking things apart to study how they worked, and
become the dependable handyman of the house and an inspiring role
model to me.
LIST OF CONTRIBUTORS

Ng Keng Tiong The Manual Approach

Marc Hickling EDA-Based PCB-RE

Juan Carlos Jiménez Firmware Hacking: Huawei HG533 Router

Ng Keng Tiong X-Ray PCB-RE: Arduino UNO R3

Ng Keng Tiong Quadcopter RE: Arduino-Based Drone

Fraser Castle Infrared Thermal Imager Camera

Hellene Rigol DS1052E Digital Oscilloscope

Michel Stempin TL-WR703N Wireless Router

Phil Levchenko CD-7810 Ultrasonic Cleaner
FOREWORD

Back when the Beatles revolutionized the pop culture, hardware, software, and computers were
grouped under one classification of electronics. Today, these areas have grown so fast it's almost
impossible to keep up with happenings in the market, even for professionals who spend eight hours
or more every day working on electronics.

The transistor was invented in 1948, followed by integrated circuits in 1951; two decades later the
world's first microprocessor was born. Since then electronics has seen phenomenal growth that
outpaced other areas of science and technology. This is remarkable because there was a time when
'Open Source' didn’t exist and almost nothing was publicly available. In fact, no one was able to study,
modify, distribute, or remake a design based on something that already existed. Surprisingly, the
biggest game changer and accelerator was reverse engineering. It’s hard to imagine where some of
the big players like Apple, Compaq or HP would be without this important skillset.

Recently, while explaining to a friend what I do daily at work and how present-day reverse engineering
looks like, I put it as simply as I could that 'I support the unsupported.' In this fast-paced ever-growing
electronics industry, there are millions of obsolete equipment made by companies that are no longer
around, so you can picture the dilemma customers face when their expensive equipment have no
support and they are unable to find spare parts to service or repair them. The standard response
given is 'technology has advanced' and their equipment is 'old' or 'outdated'. This is where reverse
engineering cast a lifeline.

But while companies which provide reverse engineering services are multiplying in numbers, books
on this coveted trade was rare, if any, until four years ago when Mr NG Keng Tiong, an engineer
turned writer, released his first book, The Art of PCB Reverse Engineering. Though a relatively
unknown author back then, his work stirred up quite a buzz in the engineering community and
created a renewed interest in this subject. Almost three years later, PCB-RE: Tools & Techniques was
published with chapter contributions from several industry and academic experts such as Joe Grand,
Bill Loving and Jeff Rupert of ScanCAD International, Bob Elder, John McMaster, Dr. Sergei
Skorobogatov of Cambridge University, etc. Together, these two books offer budding enthusiasts a
glimpse into the world of reverse engineering in printed form for the first time.

In his first book, the author methodologically laid out the process of doing manual PCB-RE, a skill
which he had refined through 15 years of field-related experience. In his sequel, he compiled a series
of automated and semi-automated processes employed by the PCB-RE industry, to give a more
complete treatment to the subject. And just when we thought we have seen enough, he added a third
book to his collection of works!

PCB-RE Real-World Examples is perhaps the most logical and natural extension to bring this niche
subject to a whole new level, where readers can see for themselves how PCB-RE work out in real-life,
practical aspects. While it is by no means exhaustive, the content should more than make up for what
is lacking in the fragmented information available online. Of course, there will always be room for
improvement——if more engineers in this line of work are willing to come forward and contribute their
share of knowledge, the way this author did with his own experience and those he invited.

PCB-RE: Real-World Examples 5
It's no small feat that Mr NG has brought together a small community of reverse engineering
professionals and hobbyists with his books and blog. For this, I am delighted and thankful. Indeed,
the common thread that runs through like-minded PCB-RE practitioners, amateurs and professionals
alike, is a burning passion for electronics, not only to know how things work but the designs that
make them exist in the first place. So if you want to learn PCB-RE, you can't go wrong with this author's
books. But be warned: PCB-RE is a lifelong learning and growing journey that does not adhere to a 9-
to-5 regime. To excel and succeed, you not only have to live and breathe it but also dream it in your
sleep!

I hope many more will follow Mr NG's footsteps to build a coherent and vibrant community of PCB-RE
professionals, hobbyists, and enthusiasts. I'm sure if even just one new apprentice is gained after
reading this book, it would be worth the effort.

Amir Pasalic
CEO, ENA Electronics Inc.
Hamilton, Ontario, Canada
February 7, 2019

6
PREFACE

The great thing about trilogy is that it feels like you've got a beginning, a
middle, and an end.
Emma Thomas†

I shared the British film producer's sentiment though I must admit the fact that the sequel to my first
book was far from my mind——let alone a third book——when I embarked to write my work experience
about PCB reverse engineering. Nonetheless, PCB-RE: Tools & Techniques came out almost three
years after The Art of PCB Reverse Engineering was released, not as I had initially planned but from
the outflow of necessity. This third book was no less of a struggle than writing the first two, despite
having prior experience and greater exposure of my works through social medias and some
contributors who were kind enough to advertise for free via their personal channels and contacts. To
them I owe a great debt of gratitude. Still, the pervading sense of how well-received these books will
be by the engineering community remains to be seen, whether the success of these books stems
from the authorship or the appeal of the content.

As most readers would realize by now, my style of writing is intentionally engaging instead of the usual
dry and factual stuff found in typical engineering books‡. That said, it can be a double-edged sword
that cuts both ways. Then again, I take it from master Yoda who corrected the dejected but obliging
young Skywalker, "Do, or do not. There is no try."♀

Back to the reason for this third of the trilogy. Putting into practice what you've learned is perhaps
the most challenging thing to do, especially if there's no real-world example to take reference from.
While the first book provides a simple example using an ISA-bus SCSI host adapter to illustrate the
steps in doing manual PCB-RE, it serves only as a starting point for those embarking on this
adventurous journey. Along the way, questions and difficulties will abound, and one is left wondering
if the manual approach is even possible, let alone practical to begin with. The other alternative is to
enlist the help of tools, automated or semi-automated, to perform the task; this invariably incurs
additional expenses that may be hard to justify——if the aim is just to recover the schematics for
repair on an ad hoc basis.

With this in mind, I decided to expand on the practical aspect of PCB-RE, by tapping on the invaluable
experiences of engineers in this field, and supplement that with my own example of a more complex
board. Perhaps the contributions of like-minded engineers will afford budding enthusiasts a peek into
the real-world workings of PCB-RE, so they can learn from the strategies and techniques described
to develop their own methodologies.
________________________
† Emma Thomas is a British film producer, known for co-producing films such as The Prestige, Inception, the Dark Knight
trilogy, Interstellar and Dunkirk.
‡ It's not surprising that a 65-year-old retired engineer who read my first book in two days exclaimed, "It's just like reading
a good detective novel!"
♀ Yoda's most famous quote in Star Wars: The Empire Strikes Back, in which the Jedi master mentored Luke Skywalker
before raising the X-wing fighter from the swamp. This quote has become a modern slogan——to be brave and completely
committed to what one is doing, win or lose.
PCB-RE: Real-World Examples 7
And as far as my own example is concerned, while the illustrations are done using Microsoft Visio,
the process of solving the interconnectivity puzzle is generic. Prior familiarity with the steps
mentioned in my first two books, though not a necessity, is advantageous to get up to speed and
essential if the reader intends to use the same diagramming tool.

Hopefully, this book will give the reader additional perspectives and ideas that will enrich the PCB-RE
learning process——and inspire more engineers to take up this challenging yet rewarding practice
that is gaining recognition and importance in the PCB repair and refurbish industry. To borrow the
words of Tony Stark:

Heroes are made by the path they choose, not the powers they are
graced with.

The same goes without saying for every PCB-RE engineer, known or unknown.

Ng Keng Tiong
Author and Chief Editor
February 25, 2019

8
ACKNOWLEDGEMENTS

There is no short cut or easy path to the mastery of a skill. Knowledge is no substitution
for real-life hands on experience. To become a master craftsman, there is only one
advice: Practice, practice, practice!

Experience is a precious commodity, more so when it comes from engineers who do PCB-RE. While
most would prefer to keep what they know to themselves, some see the benefits of sharing what
they've acquired to help others navigate uncharted waters and avoid the pitfalls that beset them.
These are the wonderful people worthy of mention here:

Juan Carlos Jiménez the firmware developer and embedded security consultant who owns Demux
Labs and specializes on Internet of Things (IoT) security. Learn the basics of hardware hacking and
firmware decoding as he shows you the intricate process of reversing a Huawei HG533 wireless
router.

Marc Hickling of ENA Electronics Inc. for making time from his busy work schedule and family
commitment (he just had a newborn addition at this writing) to put together a chapter that highlights
various PCB-RE projects using two different EDA tools——DipTrace and Target3001! While no
engineering documentation is provided for non-disclosure reasons, the process is clearly explained
and should be useful for those contemplating this approach.

Fraser Castle for his candid but engaging narrative of how he went about to repair an infrared thermal
imager camera, and in the process let readers have a glimpse into the inner thought process of a
real engineer at work.

Hellenea is the very first engineer to take apart a digital oscilloscope and performed a near complete
reversal of its schematics. Well, not quite as much as we would like to have it but hey, who else would
go through the trouble and then post his works online for free to share with the engineering
community? And as far as I'm concerned, he's one heck of a PCB-RE engineer to even do it without
the aid of a software diagramming tool!

Michel Stempin for putting up his PCB-RE work on the TP-Link TL-WR703N wireless router under the
use of Creative Commons Attribution Share-Alike license. He demonstrates that it is possible to
recreate the PCB artwork and back-annotate its schematic. He is also the first to employ the 5W1H
technique in his explanation.

Phil Levchenko for his brief write-up with a beautifully drawn schematic diagram of his dead ultrasonic
cleaner. To put it in the author's own words, "It’s corpse can serve us in a way other than cleaning
stuff." I'm glad nothing goes to waste when it comes to PCB-RE.

________________________
a Hellene is his pen name. I found out from the EEVblog forum that his first name is George and he resides in Athens,
Greece.
PCB-RE: Real-World Examples 9
Mathew Schwartz for the use of his X-ray images to illustrate the process of reversing an Arduino UNO
R3 board, which is deposited at Unsplash.com for free download and use in whatever purpose
deemed fit. As a courtesy, I dropped him an email and in return he sent me a better resolution image!

Amir Pasalic, CEO of ENA Electronics Inc., who graciously reviewed the proof copy of this book and
penned the Foreword. It's been a great honor to have you on-board at such a short notice and to play
pivotal roles as an avid reader and austere reviewer. It's like the sweet icing on an already awesome
piece of cake!

Of course, not forgetting the numerous individuals and organizations for the use of their works to add
'sight and sound' to a would-be otherwise boring 'word-only' engineering narratives, for which the
author gives due credit in their respective appearances, as far as each source is identifiable and
known.

10