0
\$\begingroup\$

Background story is that during firmware update of a generic IP Camera, with great wisdom, I managed to wipe part of the embedded Linux files, and in order to recover it, I need to access the bootloader through serial.

The PCB has no special identification, except for the strings "MP-3.4" and "1238" on the board itself.

Top view: Generic IP Camera PCB top view picture

Bottom view: enter image description here

First I looked for the J2 label, which from my understanding usually means JTAG or Serial port with this kind of generic camera.

My first suspicion laid upon the 4 connections at the top left corner of the top view:

top 4 connectors at the top left

I measures 3.3v between the two adjacent right pins, but the two to the left did not provide any output, and the Serial to USB adapter I am using remained silent.

I can identify all the chips on the board, as someone else with the same board described here, but could not find any schematics for it that would direct me to the Serial pins.

Do I have a better option other than brute forcing every pin that looks like it's not connected to any component? Is there some kind of best practice to follow when reversing such board? Anyone has any experience with this board?..

| improve this question | |
\$\endgroup\$
  • 3
    \$\begingroup\$ J# is usually just a designation for any kind of jumper cables/connectors etc. and has usually nothing to do with jtag. Also note that there are quite some devices out there where the jtag connectors are distributed around the pcb. unless someone else just happens to know it because he already did it, you would have to identify the chip responsible for implementing jtag and trace the traces. oh btw. your inductor there looks broken... \$\endgroup\$ – PlasmaHH Jan 28 '15 at 9:48
  • \$\begingroup\$ There are indeed some pins scattered around that also look suspicious, like the one with "3.3v" label, but I really hoped JTAG would be labeled.. And my question was more about the best practice for reversing it, and less about someone who knows this exact PCB, although I would be very happy if someone does. If you believe that tracing the JTAG pins from the right chip is the way, I would appreciate it if you could write that as an answer. And your observation is accurate... the inductor is broken a bit, but works :) \$\endgroup\$ – Omer Jan 28 '15 at 9:56
  • \$\begingroup\$ There seems to be a good crossover between ee.se and reverseengineering.se for this question. I am not sure if people over there might have more experience in finding such things. \$\endgroup\$ – PlasmaHH Jan 28 '15 at 9:58
  • \$\begingroup\$ From my experience with RESE, most of the participants are software people. If there would have been a "Hardware SE" I guess this question would suite it most. \$\endgroup\$ – Omer Jan 28 '15 at 9:59
  • \$\begingroup\$ Google "chip whisperer", it was a project to identify things like this on random boards, might give you some pointers. \$\endgroup\$ – John U Jan 28 '15 at 11:24
2
\$\begingroup\$

Well I'd start with the datasheet for the ralink. He's clearly the controller in this system. You could look at its pin list, find the location of serial or jtag pins, and then search that corner of the chip on the board. It will take a lot of poking and measuring but maybe you'll get lucky and their boot loader puts a message out at startup and you can see that on a scope.

Reverse engineering is an exercise in patience and trial and error, followed by more trial and error.

On the other hand the Linux files are not stored in the ralink but rather externally in a little flash part. The datasheet suggests it supports boot from spi-flash, so look up the other part numbers on the chips on your board and see if one is a spi-flash. You could then just pull it off and program it with a little programmer (they're not that expensive). That might be an easier path if you know what needs to be programmed in. Even better if you have another camera and you could just clone its flash.

It does mention nand flash support but I didn't see boot from nand flash.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ thank you very much. Flushing the EEPROM might be a problem both because I'll need to remove and return it, and because I don't know the format the data should be arranged with. Cloning existing flash sounds a good idea although I might risk destroying a perfectly good camera along the way (trial and error ;) \$\endgroup\$ – Omer Jan 28 '15 at 14:23
2
\$\begingroup\$

Although this post is old, I'd answer this in case it can help someone in future. We can use Jtagulator to find the JTAG pins. Module can found on http://www.grandideastudio.com/jtagulator/

or JTAGenum which is open source which can be ported on Raspberry Pi or Arduino module.

https://github.com/cyphunk/JTAGenum

| improve this answer | |
\$\endgroup\$
1
\$\begingroup\$

If I'm understanding you correctly you don't have the exact same camera discussed in the openipcam.com forum thread you linked? Do you know that it at least has the same chips? If they're different board designs then any information from that thread is probably useless.

The first step is working out what chip you want to talk to. The ones I can read are:

  • Pulse H1102NL - Ethernet transformer
  • Ralink RT5350F - SoC combining Ethernet, wifi, USB host and CPU
  • ULN2803AG - Darlington transistor array

I suspect that you want to talk to the Ralink. The datasheet is here.

Unfortunately it's a 196 pin BGA package, which makes it very hard to find where specific pins go on the board. The first step is probably looking at the datasheet and identifying where the JTAG pins are located. Page 6 tells us that they are pins:

  • A11 JTAG_TRST_N
  • A12 JTAG_TCLK
  • A13 JTAG_TMS
  • A14 JTAG_TDI
  • B11 JTAG_TDO

The pinout for the part is given on page 217, which tells us that row A is the one marked with a dot. That means that your JTAG pins are the ones closest to the bottom left of your IC. There's a big run of traces going from that area towards the bottom left of your board. It seems to me quite likely that the top 4 of that run are A14 down to A11 (B11 might be anywhere...)

You could try tracing the traces through their vias and around the board (which appears to only be double layered) until you reach a connector or a dead end.

Ultimately reverse engineering a board of which you have no real knowledge is hard, especially with BGA packages. It's also possible that there isn't an accessible JTAG connector on the board.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ I do have the exact same camera. Thank you for the elaborated answer. \$\endgroup\$ – Omer Jan 28 '15 at 14:20
  • \$\begingroup\$ If you have the exact same camera then why can't you find J2 on the camera board? \$\endgroup\$ – LeoR Jan 28 '15 at 14:38
  • \$\begingroup\$ The guy in openipcom.com couldn't find it either. He, in oppose to me, could do telnet to the device and used it to recover the files. \$\endgroup\$ – Omer Jan 28 '15 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.