https://wiki.recessim.com/w/api.php?action=feedcontributions&feedformat=atom&user=Chicken RECESSIM - User contributions [en] 2026-05-09T09:36:16Z User contributions MediaWiki 1.34.1 https://wiki.recessim.com/w/index.php?title=Software_Tools&diff=2038 Software Tools 2023-10-09T01:10:38Z <p>Chicken: /* Debugger / disassembler for unmanged binaries */ typos</p> <hr /> <div>[[File:Schematic Capture.png|thumb|Schematic of an embedded device]]<br /> Disassemblers, Decompilers, Development Tools, Schematic/PCB Capture and other reverse engineering software. If you used it while reverse engineering, list it here!<br /> ==Tool Index==<br /> &lt;br /&gt;<br /> <br /> ====RF Signals Analysis====<br /> <br /> *[https://github.com/jopohl/urh Universal Radio Hacker] - tool to analyze and extract data from SDR-captured radio signals (especially pilots, [[Wikipedia:ISM_radio_band|ISM RF]] devices, etc). See youtube for tutorials and examples.<br /> <br /> *[https://www.gnuradio.org/ GNU Radio] - toolkit that provides signal processing blocks to implement software-defined radios and signal processing systems.<br /> <br /> *[https://github.com/audacity/audacity Audacity] - is a audio editor that can be used to cleanup the radio waves captured by a [[Wikipedia:Software-defined_radio|SDR]] or Software Defined Radio. (Example: Start Audacity -&gt; Import –&gt; Raw Data -&gt; Radio Wave File)<br /> <br /> ----<br /> <br /> <br /> ====Firmware Analysis====<br /> <br /> *[https://github.com/ReFirmLabs/binwalk binwalk] - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.<br /> <br /> *[https://github.com/attify/firmware-analysis-toolkit FAT] - is a toolkit built in order to help security researchers analyze and identify vulnerabilities in IoT and embedded device firmware.<br /> <br /> *[https://github.com/rampageX/firmware-mod-kit Firmware Modification Kit] - is a collection of scripts and utilities to extract and rebuild linux based firmware images.<br /> <br /> *[https://github.com/craigz28/firmwalker Firmwalker] - is a script for searching the extracted firmware file system for goodies!<br /> <br /> ====Setup or Overlay Unpackers / Extractors====<br /> <br /> *[https://innounp.sourceforge.net/ innounp] - the Inno Setup Unpacker.<br /> <br /> *[https://github.com/Bioruebe/UniExtract2 Universal Extractor 2 (UniExtract2)] - is a tool designed to extract files from any type of extractable file.<br /> <br /> *[https://github.com/activescott/lessmsi lessmsi] - a tool to view and extract the contents of an Windows Installer (.msi) file.<br /> <br /> *[https://github.com/crackinglandia/fuu FUU] - &amp;#91;F&amp;#93;aster &amp;#91;U&amp;#93;niversal &amp;#91;U&amp;#93;npacker.<br /> <br /> ====Binary PE Analysis / Editor (Windows)====<br /> <br /> *[https://web.archive.org/web/20210331144912/https://protectionid.net/ ProtectionID] - Great little tool to scan a Windows binary payload for overlays and packers. [[File:ProtectionId.690.December.2017.zip|thumb|PiD.690.zip]] [https://www.virustotal.com/gui/file/26c54eb376183d508ee129531728f9e01d30f0df29d7621f390e8f0ea6a1c79c/community VT link], pw: recessim.com<br /> <br /> *[https://web.archive.org/web/20220331063153/http://www.rdgsoft.net/ RDG Packer Detector] - is a detector for packers, cryptors, compilers, installers.<br /> <br /> *[https://github.com/hasherezade/pe-bear PE-bear] - is a Portable Executable reversing tool with a friendly GUI using the Capstone Engine and is Open Source!<br /> <br /> *[https://ntcore.com/?page_id=388 CFF Explorer] - is a PE editor called CFF Explorer and a process viewer with a lot of features.<br /> <br /> ====IAT Reconstructors (Windows)====<br /> <br /> *[https://github.com/x64dbg/Scylla NtQuery Scylla] - is a Windows Portable Executable imports reconstructor open source and part of x64dbg.<br /> <br /> ====API monitoring ring3 (Windows)====<br /> <br /> *[http://jacquelin.potier.free.fr/winapioverride32/ WinAPIOverride] - is an advanced api monitoring software for 32 and 64 bits processes. You can monitor and/or override any function of a process.<br /> <br /> *[http://www.rohitab.com/apimonitor Rohitab API Monitor] - is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.<br /> <br /> ----<br /> <br /> <br /> ====Debugger / disassembler for unmanged binaries====<br /> <br /> *[https://binary.ninja/ Binary Ninja] - reverse-engineering platform that can disassemble a binary and display the disassembly in linear or graph views.<br /> <br /> *[https://www.nsa.gov/resources/everyone/ghidra/ Ghidra] - Ghidra is an open source software reverse engineering (SRE) framework developed by NSA's [https://www.nsa.gov/what-we-do/research/ Research] Directorate for NSA's [https://www.nsa.gov/what-we-do/cybersecurity/ cybersecurity mission].<br /> <br /> *[https://www.hex-rays.com/products/ida/ IDA] - The IDA Disassembler and Debugger is an interactive, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X.<br /> <br /> *[https://github.com/vivisect/vivisect Vivisect] - Vivisect binary analysis framework. Includes Disassembler, Debugger, Emulation and Symbolik analysis engines. Includes built-in Server and Shared-Workspace functionality. Runs interactive or headless, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X (Pure-Python, using ctypes to access underlying OS debug mechanism). Supports RevSync via plugin, allowing basic collaboration with Binja, Ghidra, and IDA. Criticisms (from a core dev): &quot;Graph View could use some work, slower than Binja and IDA (due to Python), documentation like an OpenSource Project... but we keep working to make it better. PR's and suggestions welcome.&quot; Best installed via Pip: &lt;code&gt;python3 -m pip install vivisect&lt;/code&gt;<br /> <br /> *[https://codisec.com/veles/ Veles] - Open source tool for binary data analysis (No longer actively developed).<br /> <br /> *[https://www.immunityinc.com/products/debugger/ Immunity Debugger] - is a powerful new way to write exploits, analyze malware, and reverse engineer Windows binary files (python support)<br /> <br /> *[https://www.hopperapp.com/ Hopper] - Hopper can use LLDB or GDB, which lets you debug and analyze the binary in a dynamic way (only for Mac and Linux hosts, not for mobile devices).<br /> <br /> *[https://x64dbg.com/ x64dbg] - Is a powerful Open Source Ollydbg replacement with a User Interface very similar to Ollydbg also x64dbg as the name states offers x64 support.<br /> <br /> *[https://github.com/uxmal/reko Reko] - Reko is a binary decompiler for static analysis (ARM, x86-64, M68K, Aarch65, RISC-V and dotnet)<br /> *[https://rada.re/ radare2] and [https://rizin.re/ Rizin] - radare2 and its fork Rizin are open source reverse engineering frameworks. Both are primarily used through a shell-like text UI, but also offer GUIs called [https://rada.re/n/iaito.html iaito] and [https://cutter.re/ Cutter] respectively.<br /> <br /> ====Debugging and Profiling dynamic analysis (Linux)====<br /> <br /> *[https://valgrind.org/ valgrind] - Valgrind is a GPL'd system for debugging and profiling Linux programs. With Valgrind's tool suite you can automatically detect many memory management and threading bugs, avoiding hours of frustrating bug-hunting, making your programs more stable.<br /> <br /> *[https://libcsdbg.sourceforge.net/jTracer/ jTracer] - is a stack trace visualization utility for libcsdbg. In other words, it acts as a TCP/IP server for libcsdbg clients, that connect to it and transfer their trace data, either C++ exception stack traces or generic thread stack traces and whole process stack dumps.<br /> <br /> ====Debugger / disassembler for manged binaries====<br /> <br /> =====.NET=====<br /> <br /> *[https://github.com/dnSpy/dnSpy dnSpy] - is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available.<br /> <br /> *[https://github.com/icedland/iced Iced] - Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua.<br /> <br /> *[https://github.com/icsharpcode/ILSpy ILSpy] - NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&amp;more) - cross-platform!<br /> <br /> *[https://www.telerik.com/products/decompiler.aspx Telerik JustDecompile] - is a free .NET decompiler and assembly browser that makes high-quality .NET decompilation easy With an open source decompilation engine.<br /> <br /> *[http://www.reteam.org/board/showthread.php?t=939 dotNET Tracer 2.0 by Kurapika] - is a simple tool that has a similar functionality to RegMon or FileMon but it's designed to trace events in .NET assemblies in runtime. [[File:KDT2.0.zip|thumb]] [https://www.virustotal.com/gui/file/d29afcc5115c28f9892f7a6d249423374ad77ac86f69b316665c347982975d02 VT1] [https://www.virustotal.com/gui/file/04cd51dbbc3d2b4fe4a721e4ad0c2f3012fe0f409dc902b430207ea25561ff8c VT2] (thermida packed), pw: recessim.com<br /> <br /> ======.NET deobfuscators======<br /> <br /> ::*[https://github.com/ViRb3/de4dot-cex de4dot CEx] - is a deobfuscator based on de4dot with full support for vanilla ConfuserEx.<br /> <br /> ::*[https://github.com/de4dot/de4dot de4dot] - is a .NET deobfuscator and unpacker.<br /> <br /> =====JAVA=====<br /> <br /> *[https://github.com/skylot/jadx Jadx] - Dex to Java decompiler. Command-line and GUI tools for producing Java source code from Android Dex and apk files.<br /> <br /> *[https://github.com/Col-E/Recaf Recaf] - Recaf is an open-source Java bytecode editor that simplifies the process of editing compiled Java applications.<br /> <br /> *[https://www.pnfsoftware.com/ JEB decompiler] - Decompile and debug Android dalvik, Intel x86, ARM, MIPS, RISC-V, S7 PLC, Java, WebAssembly &amp; Ethereum Decompilers.<br /> <br /> *[https://github.com/honeynet/apkinspector/ APKinspector] - is a powerful GUI tool for analysts to analyze the Android applications.<br /> <br /> *[https://apktool.org/ Apktool] - A tool for reverse engineering Android apk files.<br /> <br /> *[https://github.com/Konloch/bytecode-viewer Bytecode viewer] - A Java 8+ Jar &amp; Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger &amp; More)<br /> <br /> ======Java deobfuscators======<br /> <br /> ::*[https://github.com/java-deobfuscator/deobfuscator deobfuscator] - is a project that aims to deobfuscate most commercially-available obfuscators for Java. [https://github.com/java-deobfuscator/deobfuscator-gui GUI version github]<br /> ::*[https://github.com/narumii/Deobfuscator Another Deobfuscator] - Some deobfuscator for java. Supports superblaubeere27 / JObf / sb27, Paramorphism 2.1.2_9, Caesium, Monsey, Skid/qProtect, Scuti, CheatBreaker, Bozar, ...<br /> <br /> =====PYTHON=====<br /> <br /> *[https://github.com/rocky/python-uncompyle6 uncompyle6] - is a native Python cross-version decompiler and fragment decompiler. The successor to decompyle, uncompyle, and uncompyle2.<br /> <br /> *[https://github.com/zrax/pycdc pycdc] - is a C++ python bytecode disassembler and decompiler.<br /> <br /> <br /> ----<br /> <br /> ====PC platform exploration frameworks====<br /> <br /> *[https://github.com/chipsec/chipsec Chipsec] - is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities.<br /> <br /> *[https://github.com/rapid7/metasploit-framework Metasploit Framework] - is a Framework is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code.<br /> <br /> *[https://github.com/Arachni/arachni Arachni] - is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.<br /> <br /> *[https://portswigger.net/burp Burp Suite] - Burp or Burp Suite is a set of tools used for penetration testing of web applications.<br /> <br /> <br /> ====Mobile exploration frameworks====<br /> <br /> *[https://frida.re/ Frida] - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.<br /> <br /> *[https://github.com/sensepost/objection objection] - is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.<br /> <br /> *[https://github.com/mingyuan-xia/AppAudit AppAudit] - is an efficient program analysis tool that detects data leaks in mobile applications. It can accurately find all leaks within seconds and ~200 MB memory.<br /> <br /> *[https://github.com/LSPosed/LSPosed LSposed] - is a Riru / Zygisk module trying to provide an ART hooking framework which delivers consistent APIs with the OG Xposed, leveraging LSPlant hooking framework.<br /> <br /> *[https://github.com/ElderDrivers/EdXposed Xposed Framework] - is a framework for mobile exploration hooking and modifying code on the fly. [https://binderfilter.github.io/xposed/ Inline API hooking example].<br /> <br /> ::Xposed modules<br /> :::*[https://github.com/Fuzion24/JustTrustMe JustTrustMe] - Art framework hook to patch okHTTP and other common libs to fool the CERT chain in order for Mitmproxy to capture TLS traffic in cleartext.<br /> :::*[https://github.com/sanfengAndroid/FakeXposed FakeXposed] - Hide xposed, root, file redirection, two-way shielding data detection.<br /> :::*[https://github.com/ac-pm/SSLUnpinning_Xposed/ SSLUnpinning_Xposed] - Android Xposed Module to bypass SSL certificate validation (Certificate Pinning)..<br /> <br /> ====Promiscuous mode eavesdropping TCP/UDP====<br /> <br /> ::*[https://github.com/mitmproxy/mitmproxy mitmproxy] - is an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.<br /> <br /> ::*[https://gitlab.com/wireshark/wireshark wireshark] - is a network traffic analyzer, or &quot;sniffer&quot;, for Linux, macOS, &amp;#42;BSD and other Unix and Unix-like operating systems and for Windows.<br /> <br /> ::*[https://github.com/SensePost/Mallet Mallet] - is an intercepting proxy for arbitrary protocols.<br /> <br /> ----<br /> <br /> ====Unified Extensible Firmware Interface (UEFI) &amp; legacy PC BIOS Tools====<br /> <br /> ::'''UEFI'''<br /> ::*[https://github.com/LongSoft/UEFITool UEFITool / UEFIExtract / UEFIFind] - is a UEFI firmware image viewer and editor.<br /> ::*[https://github.com/LongSoft/IFRExtractor-RS IFRExtractor-RS] - is a Rust utility to extract UEFI IFR (Internal Form Representation) data found in a binary file into human-readable text.<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.01_x64.exe AMIBCP_5.01_x64] - AMI BIOS Configuration Program (AMIBCP) is a powerful customization utility that enables OEMs/ODMs to customize the Aptio® ROM image without intervening on the source code. [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b VT link]<br /> ::*[https://github.com/tylernguyen/razer15-hackintosh/blob/master/tools/AMIBCP64/AMIBCP64.exe AMIBCP 5.01.0014 x64] [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b/details VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.02.0023.exe AMIBCP_5.02.0023] [https://www.virustotal.com/gui/file/38f7c54098af1544ddba6324e6d1fea6d1462f422ba021f309ad4445dacd0467 VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.02.0031.exe AMIBCP_5.02.0031] [https://www.virustotal.com/gui/file/c7ade67fe0e8f4c22f73ce3168ff6e718086f1eda83cce4c065b4fe49bd5ad99 VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP%205.02.0034.exe AMIBCP 5.02.0034] [https://www.virustotal.com/gui/file/7fe28fb8a7419c95fba428891e5b3914d9e2b365a5a8932da74db52a1c1dabd8 VT link]<br /> <br /> ::'''BIOS'''<br /> :::'''AMI'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_2.25.zip AMIBCP_2.25] [https://www.virustotal.com/gui/file/71050f3db40cc6c0a623d66c8eeb05d0a0818226fd11ed787452f4f540d45204 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_2.43.zip AMIBCP_2.43] [https://www.virustotal.com/gui/file/efa10cfe5f78c16982abf458eb50a4fde152631ad3b77838bd2013a763045ced VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.13.exe AMIBCP_3.13] [https://www.virustotal.com/gui/file/e0a5b1059f04813e72c6d4fa639d32567002fdd86321895b5987224a4518896e VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.37.exe AMIBCP_3.37] [https://www.virustotal.com/gui/file/1174e177b28fb7ecbac6c5043a9e8d78ff4756f657ea72369c5fb6b43b1f2623 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.46.exe AMIBCP_3.46] [https://www.virustotal.com/gui/file/84bd5b151286d4181ef26284d96ca49074e18574b8454c51cb0b34013ee5d073 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.47.exe AMIBCP_3.47] [https://www.virustotal.com/gui/file/20d93c6f868d4638676b7cde2c66c5589433c1480250aa0d774c4feef3337507 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.51.exe AMIBCP_3.51] [https://www.virustotal.com/gui/file/0d630b4b9c34d6c7132249a1a7bc3de33b39779fc90d9a367272cf57b4621aed VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_4.53.exe AMIBCP_4.53] [https://www.virustotal.com/gui/file/3f90e402dab9f64cbc4514e18bc2625ec7672da806cd9e0ef2e803b0ce104a01 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_4.55.exe AMIBCP_4.55] [https://www.virustotal.com/gui/file/451ad821a66e9ea89ee0544ce53cfab887dc0bb662a2de95f0e1aa1663dc6e06 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_2.22.1.exe MMTOOL_2.22.1] - MMtool stands for Module Management Tool. As one of AMI's BIOS/UEFI utilities, MMTool allows users to manage firmware file modules within the Aptio ROM image. [https://www.virustotal.com/gui/file/cf49f1e742f5cce68152f3c17df29e5c9aa7fb557c432402199159ffda44e007 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.12.exe MMTOOL_3.12] [https://www.virustotal.com/gui/file/78c3ca427878be5b07058f422914027462d3ac740b0de247169cc0aee4195e3b VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOl_3.19.exe MMTOOl_3.19] [https://www.virustotal.com/gui/file/b4b30c6ff911f18d3383b094628f59aa5ec3b109acd12aaef391acf9720e52af VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.19_Mod_21FiX.exe MMTOOL_3.19_Mod_21FiX] [https://www.virustotal.com/gui/file/66e2717fcac67b073d24916c74bc8d8dd7932b188d20b8b635b511e6195d5855 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22.EXE MMTOOL_3.22] [https://www.virustotal.com/gui/file/5616a62d2b50a53490bb705b769ed86bf4b49799663a814fcd1284ebc0bdc62f VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22_1B_21Fix-BKMOD.EXE MMTOOL_3.22_1B_21Fix-BKMOD] [https://www.virustotal.com/gui/file/5616a62d2b50a53490bb705b769ed86bf4b49799663a814fcd1284ebc0bdc62f VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22_CN_BKMod.exe MMTOOL_3.22_CN_BKMod] [https://www.virustotal.com/gui/file/f467d75962278a4e01d646cdf8008136912d8a1ddd588c45e2fcee9d7cd17140 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.23_CN_BKMod.exe MMTOOL_3.23_CN_BKMod] [https://www.virustotal.com/gui/file/9bf846d023312c889069b03f5ab7157e270fc67c5d295e745d0a5f27d12a71de VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.26.exe MMTOOL_3.26] [https://www.virustotal.com/gui/file/c5a64ea7ce2bea8556fa81e0069adbba793181bfaa76f59f4f472f0a471bac98 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_4.50.0.23.exe MMTOOL_4.50.0.23][https://www.virustotal.com/gui/file/7d0377a72e67e5a71400361416452440826832aeb2c9bebaa578e8af962eaafd VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.0.07.exe MMTOOL_5.0.07] [https://www.virustotal.com/gui/file/28049163fd1e3423c42b229a5f6ed877f14e7caf3b794bf7efb970b375e6ff41 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.02.0024.exe MMTOOL_5.02.0024] [https://www.virustotal.com/gui/file/bbc3e75905997ddc05c523e57a72e49bbfcaf84dca64e460f10f8553b7fda9ee VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.02.0025.exe MMTOOL_5.02.0025] [https://www.virustotal.com/gui/file/5d05d0bbea720d4b73dc66db55031c2659458696b9f143df3b7e2f43040289cc VT link]<br /> :::'''Award'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/tree/main/Award_Bios_Editor Award Bios Editor] - is a editor for Award bios.<br /> :::'''Insyde'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x86/H2OEZE_x86_WIN_100.00.02.13.zip H2OEZE_x86_WIN_100.00.02.13] - H2OEZE™: Easy BIOS Editor that helps edit binaries in the BIOS, including Option ROMs, driver binaries, logos, and Setup values. [https://www.virustotal.com/gui/file/9660f1bf9436b258ec5ad857a94fbd0ec1f8fbff8ab22ca1dfcfb5ebbdcedf08 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x86/H2OEZE_x86_WIN_100.00.03.04.zip H2OEZE_x86_WIN_100.00.03.04] [https://www.virustotal.com/gui/file/2a1005803da854693502093445906eb2cccb24947d6828bc1533ba3603c73b0a VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x64/H2OEZE_x64_WIN_100.00.03.04.rar H2OEZE_x64_WIN_100.00.03.04] [https://www.virustotal.com/gui/file/20d2d0336d30afd0b1961eb42dc061ce66a6fcfbfba1530e7abd9be883dcb45c VT link]<br /> <br /> <br /> :Download all tools in one archive, [https://github.com/direstraits96/BIOS-MOD-TOOLS/archive/refs/heads/main.zip click here]. [https://www.virustotal.com/gui/file/d8a75883ca8d292adcf40e5ed88584579b1c0c69f6ad5837fc56747233c56f9c VT link]<br /> <br /> ----<br /> <br /> ====Operating System for Penetration Testing &amp; Digital Forensics====<br /> <br /> *[https://www.kali.org/ Kali Linux] - is an open-source, Debian-based Linux distribution geared towards various information security tasks, such as Penetration Testing, Security Research, Computer Forensics and Reverse Engineering.<br /> <br /> *[https://www.backbox.org/ BlackBox] is more than an operating system, it is a Free Open Source Community Project with the aim of promoting the culture of security in IT environment and give its contribution to make it better and safer.<br /> <br /> *[https://blackarch.org/ BlackArch] - is an Arch Linux-based penetration testing distribution for penetration testers and security researchers.<br /> <br /> *[https://www.parrotsec.org/ Parrot Security] - is based on top of Debian, the most advanced and recognized universal operating system that can run anywhere.<br /> <br /> *[https://labs.fedoraproject.org/security/ Fedora Security Spin] - is a live media based on Fedora to provide a safe test environment for working on security auditing, forensics and penetration testing, coupled with all the Fedora Security features and tools.<br /> <br /> *[https://www.caine-live.net/ CAINE] - CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution created as a Digital Forensics project.<br /> <br /> *[https://github.com/dracos-linux Dracos Linux] - is the Linux operating system from Indonesia, open source is built based on Debian live project under the protection of the GNU General Public License v3.0. This operating system is one variant of Linux distributions, which is used to perform security testing (penetration testing). Dracos linux in Arm by hundreds hydraulic pentest, forensics and reverse engineering.<br /> <br /> *[https://www.pentoo.ch/ Pentoo] - is a Live CD and Live USB designed for penetration testing and security assessment. Based off Gentoo Linux, Pentoo is provided both as 32 and 64 bit installable livecd.<br /> <br /> ====Privacy Operating System====<br /> <br /> *[https://tails.net/ Tails] - is a portable operating system that protects against surveillance and censorship.<br /> <br /> <br /> ----<br /> <br /> ====Tools for opening CAD or Boardview files====<br /> '''Description''': Boardview is a type of file containing information about printed circuit boards, their components, used signals, test points and more. These files may have following extensions: .asc, .bdv, .brd, .bv, .cad, .cst, .gr, .f2b, .fz, .tvw and others.<br /> <br /> *[https://pldaniels.com/flexbv5/ FlexBV] - Advanced FlexBV boardview software integrates your boardview files with PDF schematics to substantially ease the process of tracking down faults and understanding damaged boards<br /> <br /> *[http://boardviewer.net/ BoardViewer] - BoardViewer is software intended for viewing various boardview file types<br /> <br /> *CADview - simple old tool for viewing CAD files of PCB's. [[File:CAD View.zip|thumb]] [https://www.virustotal.com/gui/file/9a64621ff34d8d674ba6580538908f4ea170fee9cc1cb700485bd41e3a3a42df VT link]<br /> <br /> For resources to open in your favorite boardview program visit <br /> [[Literature#Datasheets_boardviews_.26_schematics|Literature -&gt; 1.2 Datasheets boardviews &amp; schematics]]<br /> <br /> ==Education==<br /> Tools are great, and sometimes free! Without knowing how to use them, they can be a big waste of time. Better to spend your time learning the basics, then apply your knowledge. <br /> <br /> [https://github.com/mytechnotalent/Reverse-Engineering-Tutorial Reverse Engineering Tutorial] - A comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM &amp; 64-bit ARM architectures.</div> Chicken https://wiki.recessim.com/w/index.php?title=Software_Tools&diff=2037 Software Tools 2023-10-09T01:08:48Z <p>Chicken: /* Debugger / disassembler for unmanged binaries */ added radare2 and Rizin</p> <hr /> <div>[[File:Schematic Capture.png|thumb|Schematic of an embedded device]]<br /> Disassemblers, Decompilers, Development Tools, Schematic/PCB Capture and other reverse engineering software. If you used it while reverse engineering, list it here!<br /> ==Tool Index==<br /> &lt;br /&gt;<br /> <br /> ====RF Signals Analysis====<br /> <br /> *[https://github.com/jopohl/urh Universal Radio Hacker] - tool to analyze and extract data from SDR-captured radio signals (especially pilots, [[Wikipedia:ISM_radio_band|ISM RF]] devices, etc). See youtube for tutorials and examples.<br /> <br /> *[https://www.gnuradio.org/ GNU Radio] - toolkit that provides signal processing blocks to implement software-defined radios and signal processing systems.<br /> <br /> *[https://github.com/audacity/audacity Audacity] - is a audio editor that can be used to cleanup the radio waves captured by a [[Wikipedia:Software-defined_radio|SDR]] or Software Defined Radio. (Example: Start Audacity -&gt; Import –&gt; Raw Data -&gt; Radio Wave File)<br /> <br /> ----<br /> <br /> <br /> ====Firmware Analysis====<br /> <br /> *[https://github.com/ReFirmLabs/binwalk binwalk] - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.<br /> <br /> *[https://github.com/attify/firmware-analysis-toolkit FAT] - is a toolkit built in order to help security researchers analyze and identify vulnerabilities in IoT and embedded device firmware.<br /> <br /> *[https://github.com/rampageX/firmware-mod-kit Firmware Modification Kit] - is a collection of scripts and utilities to extract and rebuild linux based firmware images.<br /> <br /> *[https://github.com/craigz28/firmwalker Firmwalker] - is a script for searching the extracted firmware file system for goodies!<br /> <br /> ====Setup or Overlay Unpackers / Extractors====<br /> <br /> *[https://innounp.sourceforge.net/ innounp] - the Inno Setup Unpacker.<br /> <br /> *[https://github.com/Bioruebe/UniExtract2 Universal Extractor 2 (UniExtract2)] - is a tool designed to extract files from any type of extractable file.<br /> <br /> *[https://github.com/activescott/lessmsi lessmsi] - a tool to view and extract the contents of an Windows Installer (.msi) file.<br /> <br /> *[https://github.com/crackinglandia/fuu FUU] - &amp;#91;F&amp;#93;aster &amp;#91;U&amp;#93;niversal &amp;#91;U&amp;#93;npacker.<br /> <br /> ====Binary PE Analysis / Editor (Windows)====<br /> <br /> *[https://web.archive.org/web/20210331144912/https://protectionid.net/ ProtectionID] - Great little tool to scan a Windows binary payload for overlays and packers. [[File:ProtectionId.690.December.2017.zip|thumb|PiD.690.zip]] [https://www.virustotal.com/gui/file/26c54eb376183d508ee129531728f9e01d30f0df29d7621f390e8f0ea6a1c79c/community VT link], pw: recessim.com<br /> <br /> *[https://web.archive.org/web/20220331063153/http://www.rdgsoft.net/ RDG Packer Detector] - is a detector for packers, cryptors, compilers, installers.<br /> <br /> *[https://github.com/hasherezade/pe-bear PE-bear] - is a Portable Executable reversing tool with a friendly GUI using the Capstone Engine and is Open Source!<br /> <br /> *[https://ntcore.com/?page_id=388 CFF Explorer] - is a PE editor called CFF Explorer and a process viewer with a lot of features.<br /> <br /> ====IAT Reconstructors (Windows)====<br /> <br /> *[https://github.com/x64dbg/Scylla NtQuery Scylla] - is a Windows Portable Executable imports reconstructor open source and part of x64dbg.<br /> <br /> ====API monitoring ring3 (Windows)====<br /> <br /> *[http://jacquelin.potier.free.fr/winapioverride32/ WinAPIOverride] - is an advanced api monitoring software for 32 and 64 bits processes. You can monitor and/or override any function of a process.<br /> <br /> *[http://www.rohitab.com/apimonitor Rohitab API Monitor] - is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.<br /> <br /> ----<br /> <br /> <br /> ====Debugger / disassembler for unmanged binaries====<br /> <br /> *[https://binary.ninja/ Binary Ninja] - reverse-engineering platform that can disassemble a binary and display the disassembly in linear or graph views.<br /> <br /> *[https://www.nsa.gov/resources/everyone/ghidra/ Ghidra] - Ghidra is an open source software reverse engineering (SRE) framework developed by NSA's [https://www.nsa.gov/what-we-do/research/ Research] Directorate for NSA's [https://www.nsa.gov/what-we-do/cybersecurity/ cybersecurity mission].<br /> <br /> *[https://www.hex-rays.com/products/ida/ IDA] - The IDA Disassembler and Debugger is an interactive, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X.<br /> <br /> *[https://github.com/vivisect/vivisect Vivisect] - Vivisect binary analysis framework. Includes Disassembler, Debugger, Emulation and Symbolik analysis engines. Includes built-in Server and Shared-Workspace functionality. Runs interactive or headless, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X (Pure-Python, using ctypes to access underlying OS debug mechanism). Supports RevSync via plugin, allowing basic collaboration with Binja, Ghidra, and IDA. Criticisms (from a core dev): &quot;Graph View could use some work, slower than Binja and IDA (due to Python), documentation like an OpenSource Project... but we keep working to make it better. PR's and suggestions welcome.&quot; Best installed via Pip: &lt;code&gt;python3 -m pip install vivisect&lt;/code&gt;<br /> <br /> *[https://codisec.com/veles/ Veles] - Open source tool for binary data analysis (No longer actively developed).<br /> <br /> *[https://www.immunityinc.com/products/debugger/ Immunity Debugger] - is a powerful new way to write exploits, analyze malware, and reverse engineer Windows binary files (python support)<br /> <br /> *[https://www.hopperapp.com/ Hopper] - Hopper can use LLDB or GDB, which lets you debug and analyze the binary in a dynamic way (only for Mac and Linux hosts, not for mobile devices).<br /> <br /> *[https://x64dbg.com/ x64dbg] - Is a powerful Open Source Ollydbg replacement with a User Interface very similar to Ollydbg also x64dbg as the name states offers x64 support.<br /> <br /> *[https://github.com/uxmal/reko Reko] - Reko is a binary decompiler for static analysis (ARM, x86-64, M68K, Aarch65, RISC-V and dotnet)<br /> *[https://rada.re/ radare2] and [https://rizin.re/ Rizin] - radare2 and its fork Rizin are open source reverse engineering frameworks. Both are primarily used through a shell-like text UI, but also offer a GUI called [https://rada.re/n/iaito.html iato] and [https://cutter.re/ Cutter] respectively.<br /> <br /> ====Debugging and Profiling dynamic analysis (Linux)====<br /> <br /> *[https://valgrind.org/ valgrind] - Valgrind is a GPL'd system for debugging and profiling Linux programs. With Valgrind's tool suite you can automatically detect many memory management and threading bugs, avoiding hours of frustrating bug-hunting, making your programs more stable.<br /> <br /> *[https://libcsdbg.sourceforge.net/jTracer/ jTracer] - is a stack trace visualization utility for libcsdbg. In other words, it acts as a TCP/IP server for libcsdbg clients, that connect to it and transfer their trace data, either C++ exception stack traces or generic thread stack traces and whole process stack dumps.<br /> <br /> ====Debugger / disassembler for manged binaries====<br /> <br /> =====.NET=====<br /> <br /> *[https://github.com/dnSpy/dnSpy dnSpy] - is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available.<br /> <br /> *[https://github.com/icedland/iced Iced] - Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua.<br /> <br /> *[https://github.com/icsharpcode/ILSpy ILSpy] - NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&amp;more) - cross-platform!<br /> <br /> *[https://www.telerik.com/products/decompiler.aspx Telerik JustDecompile] - is a free .NET decompiler and assembly browser that makes high-quality .NET decompilation easy With an open source decompilation engine.<br /> <br /> *[http://www.reteam.org/board/showthread.php?t=939 dotNET Tracer 2.0 by Kurapika] - is a simple tool that has a similar functionality to RegMon or FileMon but it's designed to trace events in .NET assemblies in runtime. [[File:KDT2.0.zip|thumb]] [https://www.virustotal.com/gui/file/d29afcc5115c28f9892f7a6d249423374ad77ac86f69b316665c347982975d02 VT1] [https://www.virustotal.com/gui/file/04cd51dbbc3d2b4fe4a721e4ad0c2f3012fe0f409dc902b430207ea25561ff8c VT2] (thermida packed), pw: recessim.com<br /> <br /> ======.NET deobfuscators======<br /> <br /> ::*[https://github.com/ViRb3/de4dot-cex de4dot CEx] - is a deobfuscator based on de4dot with full support for vanilla ConfuserEx.<br /> <br /> ::*[https://github.com/de4dot/de4dot de4dot] - is a .NET deobfuscator and unpacker.<br /> <br /> =====JAVA=====<br /> <br /> *[https://github.com/skylot/jadx Jadx] - Dex to Java decompiler. Command-line and GUI tools for producing Java source code from Android Dex and apk files.<br /> <br /> *[https://github.com/Col-E/Recaf Recaf] - Recaf is an open-source Java bytecode editor that simplifies the process of editing compiled Java applications.<br /> <br /> *[https://www.pnfsoftware.com/ JEB decompiler] - Decompile and debug Android dalvik, Intel x86, ARM, MIPS, RISC-V, S7 PLC, Java, WebAssembly &amp; Ethereum Decompilers.<br /> <br /> *[https://github.com/honeynet/apkinspector/ APKinspector] - is a powerful GUI tool for analysts to analyze the Android applications.<br /> <br /> *[https://apktool.org/ Apktool] - A tool for reverse engineering Android apk files.<br /> <br /> *[https://github.com/Konloch/bytecode-viewer Bytecode viewer] - A Java 8+ Jar &amp; Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger &amp; More)<br /> <br /> ======Java deobfuscators======<br /> <br /> ::*[https://github.com/java-deobfuscator/deobfuscator deobfuscator] - is a project that aims to deobfuscate most commercially-available obfuscators for Java. [https://github.com/java-deobfuscator/deobfuscator-gui GUI version github]<br /> ::*[https://github.com/narumii/Deobfuscator Another Deobfuscator] - Some deobfuscator for java. Supports superblaubeere27 / JObf / sb27, Paramorphism 2.1.2_9, Caesium, Monsey, Skid/qProtect, Scuti, CheatBreaker, Bozar, ...<br /> <br /> =====PYTHON=====<br /> <br /> *[https://github.com/rocky/python-uncompyle6 uncompyle6] - is a native Python cross-version decompiler and fragment decompiler. The successor to decompyle, uncompyle, and uncompyle2.<br /> <br /> *[https://github.com/zrax/pycdc pycdc] - is a C++ python bytecode disassembler and decompiler.<br /> <br /> <br /> ----<br /> <br /> ====PC platform exploration frameworks====<br /> <br /> *[https://github.com/chipsec/chipsec Chipsec] - is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities.<br /> <br /> *[https://github.com/rapid7/metasploit-framework Metasploit Framework] - is a Framework is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code.<br /> <br /> *[https://github.com/Arachni/arachni Arachni] - is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.<br /> <br /> *[https://portswigger.net/burp Burp Suite] - Burp or Burp Suite is a set of tools used for penetration testing of web applications.<br /> <br /> <br /> ====Mobile exploration frameworks====<br /> <br /> *[https://frida.re/ Frida] - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.<br /> <br /> *[https://github.com/sensepost/objection objection] - is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.<br /> <br /> *[https://github.com/mingyuan-xia/AppAudit AppAudit] - is an efficient program analysis tool that detects data leaks in mobile applications. It can accurately find all leaks within seconds and ~200 MB memory.<br /> <br /> *[https://github.com/LSPosed/LSPosed LSposed] - is a Riru / Zygisk module trying to provide an ART hooking framework which delivers consistent APIs with the OG Xposed, leveraging LSPlant hooking framework.<br /> <br /> *[https://github.com/ElderDrivers/EdXposed Xposed Framework] - is a framework for mobile exploration hooking and modifying code on the fly. [https://binderfilter.github.io/xposed/ Inline API hooking example].<br /> <br /> ::Xposed modules<br /> :::*[https://github.com/Fuzion24/JustTrustMe JustTrustMe] - Art framework hook to patch okHTTP and other common libs to fool the CERT chain in order for Mitmproxy to capture TLS traffic in cleartext.<br /> :::*[https://github.com/sanfengAndroid/FakeXposed FakeXposed] - Hide xposed, root, file redirection, two-way shielding data detection.<br /> :::*[https://github.com/ac-pm/SSLUnpinning_Xposed/ SSLUnpinning_Xposed] - Android Xposed Module to bypass SSL certificate validation (Certificate Pinning)..<br /> <br /> ====Promiscuous mode eavesdropping TCP/UDP====<br /> <br /> ::*[https://github.com/mitmproxy/mitmproxy mitmproxy] - is an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.<br /> <br /> ::*[https://gitlab.com/wireshark/wireshark wireshark] - is a network traffic analyzer, or &quot;sniffer&quot;, for Linux, macOS, &amp;#42;BSD and other Unix and Unix-like operating systems and for Windows.<br /> <br /> ::*[https://github.com/SensePost/Mallet Mallet] - is an intercepting proxy for arbitrary protocols.<br /> <br /> ----<br /> <br /> ====Unified Extensible Firmware Interface (UEFI) &amp; legacy PC BIOS Tools====<br /> <br /> ::'''UEFI'''<br /> ::*[https://github.com/LongSoft/UEFITool UEFITool / UEFIExtract / UEFIFind] - is a UEFI firmware image viewer and editor.<br /> ::*[https://github.com/LongSoft/IFRExtractor-RS IFRExtractor-RS] - is a Rust utility to extract UEFI IFR (Internal Form Representation) data found in a binary file into human-readable text.<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.01_x64.exe AMIBCP_5.01_x64] - AMI BIOS Configuration Program (AMIBCP) is a powerful customization utility that enables OEMs/ODMs to customize the Aptio® ROM image without intervening on the source code. [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b VT link]<br /> ::*[https://github.com/tylernguyen/razer15-hackintosh/blob/master/tools/AMIBCP64/AMIBCP64.exe AMIBCP 5.01.0014 x64] [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b/details VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.02.0023.exe AMIBCP_5.02.0023] [https://www.virustotal.com/gui/file/38f7c54098af1544ddba6324e6d1fea6d1462f422ba021f309ad4445dacd0467 VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.02.0031.exe AMIBCP_5.02.0031] [https://www.virustotal.com/gui/file/c7ade67fe0e8f4c22f73ce3168ff6e718086f1eda83cce4c065b4fe49bd5ad99 VT link]<br /> ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP%205.02.0034.exe AMIBCP 5.02.0034] [https://www.virustotal.com/gui/file/7fe28fb8a7419c95fba428891e5b3914d9e2b365a5a8932da74db52a1c1dabd8 VT link]<br /> <br /> ::'''BIOS'''<br /> :::'''AMI'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_2.25.zip AMIBCP_2.25] [https://www.virustotal.com/gui/file/71050f3db40cc6c0a623d66c8eeb05d0a0818226fd11ed787452f4f540d45204 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_2.43.zip AMIBCP_2.43] [https://www.virustotal.com/gui/file/efa10cfe5f78c16982abf458eb50a4fde152631ad3b77838bd2013a763045ced VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.13.exe AMIBCP_3.13] [https://www.virustotal.com/gui/file/e0a5b1059f04813e72c6d4fa639d32567002fdd86321895b5987224a4518896e VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.37.exe AMIBCP_3.37] [https://www.virustotal.com/gui/file/1174e177b28fb7ecbac6c5043a9e8d78ff4756f657ea72369c5fb6b43b1f2623 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.46.exe AMIBCP_3.46] [https://www.virustotal.com/gui/file/84bd5b151286d4181ef26284d96ca49074e18574b8454c51cb0b34013ee5d073 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.47.exe AMIBCP_3.47] [https://www.virustotal.com/gui/file/20d93c6f868d4638676b7cde2c66c5589433c1480250aa0d774c4feef3337507 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_3.51.exe AMIBCP_3.51] [https://www.virustotal.com/gui/file/0d630b4b9c34d6c7132249a1a7bc3de33b39779fc90d9a367272cf57b4621aed VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_4.53.exe AMIBCP_4.53] [https://www.virustotal.com/gui/file/3f90e402dab9f64cbc4514e18bc2625ec7672da806cd9e0ef2e803b0ce104a01 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_4.55.exe AMIBCP_4.55] [https://www.virustotal.com/gui/file/451ad821a66e9ea89ee0544ce53cfab887dc0bb662a2de95f0e1aa1663dc6e06 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_2.22.1.exe MMTOOL_2.22.1] - MMtool stands for Module Management Tool. As one of AMI's BIOS/UEFI utilities, MMTool allows users to manage firmware file modules within the Aptio ROM image. [https://www.virustotal.com/gui/file/cf49f1e742f5cce68152f3c17df29e5c9aa7fb557c432402199159ffda44e007 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.12.exe MMTOOL_3.12] [https://www.virustotal.com/gui/file/78c3ca427878be5b07058f422914027462d3ac740b0de247169cc0aee4195e3b VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOl_3.19.exe MMTOOl_3.19] [https://www.virustotal.com/gui/file/b4b30c6ff911f18d3383b094628f59aa5ec3b109acd12aaef391acf9720e52af VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.19_Mod_21FiX.exe MMTOOL_3.19_Mod_21FiX] [https://www.virustotal.com/gui/file/66e2717fcac67b073d24916c74bc8d8dd7932b188d20b8b635b511e6195d5855 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22.EXE MMTOOL_3.22] [https://www.virustotal.com/gui/file/5616a62d2b50a53490bb705b769ed86bf4b49799663a814fcd1284ebc0bdc62f VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22_1B_21Fix-BKMOD.EXE MMTOOL_3.22_1B_21Fix-BKMOD] [https://www.virustotal.com/gui/file/5616a62d2b50a53490bb705b769ed86bf4b49799663a814fcd1284ebc0bdc62f VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.22_CN_BKMod.exe MMTOOL_3.22_CN_BKMod] [https://www.virustotal.com/gui/file/f467d75962278a4e01d646cdf8008136912d8a1ddd588c45e2fcee9d7cd17140 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.23_CN_BKMod.exe MMTOOL_3.23_CN_BKMod] [https://www.virustotal.com/gui/file/9bf846d023312c889069b03f5ab7157e270fc67c5d295e745d0a5f27d12a71de VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_3.26.exe MMTOOL_3.26] [https://www.virustotal.com/gui/file/c5a64ea7ce2bea8556fa81e0069adbba793181bfaa76f59f4f472f0a471bac98 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_4.50.0.23.exe MMTOOL_4.50.0.23][https://www.virustotal.com/gui/file/7d0377a72e67e5a71400361416452440826832aeb2c9bebaa578e8af962eaafd VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.0.07.exe MMTOOL_5.0.07] [https://www.virustotal.com/gui/file/28049163fd1e3423c42b229a5f6ed877f14e7caf3b794bf7efb970b375e6ff41 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.02.0024.exe MMTOOL_5.02.0024] [https://www.virustotal.com/gui/file/bbc3e75905997ddc05c523e57a72e49bbfcaf84dca64e460f10f8553b7fda9ee VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/MMTOOL/MMTOOL_5.02.0025.exe MMTOOL_5.02.0025] [https://www.virustotal.com/gui/file/5d05d0bbea720d4b73dc66db55031c2659458696b9f143df3b7e2f43040289cc VT link]<br /> :::'''Award'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/tree/main/Award_Bios_Editor Award Bios Editor] - is a editor for Award bios.<br /> :::'''Insyde'''<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x86/H2OEZE_x86_WIN_100.00.02.13.zip H2OEZE_x86_WIN_100.00.02.13] - H2OEZE™: Easy BIOS Editor that helps edit binaries in the BIOS, including Option ROMs, driver binaries, logos, and Setup values. [https://www.virustotal.com/gui/file/9660f1bf9436b258ec5ad857a94fbd0ec1f8fbff8ab22ca1dfcfb5ebbdcedf08 VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x86/H2OEZE_x86_WIN_100.00.03.04.zip H2OEZE_x86_WIN_100.00.03.04] [https://www.virustotal.com/gui/file/2a1005803da854693502093445906eb2cccb24947d6828bc1533ba3603c73b0a VT link]<br /> :::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/Insyde/H2OEZE/x64/H2OEZE_x64_WIN_100.00.03.04.rar H2OEZE_x64_WIN_100.00.03.04] [https://www.virustotal.com/gui/file/20d2d0336d30afd0b1961eb42dc061ce66a6fcfbfba1530e7abd9be883dcb45c VT link]<br /> <br /> <br /> :Download all tools in one archive, [https://github.com/direstraits96/BIOS-MOD-TOOLS/archive/refs/heads/main.zip click here]. [https://www.virustotal.com/gui/file/d8a75883ca8d292adcf40e5ed88584579b1c0c69f6ad5837fc56747233c56f9c VT link]<br /> <br /> ----<br /> <br /> ====Operating System for Penetration Testing &amp; Digital Forensics====<br /> <br /> *[https://www.kali.org/ Kali Linux] - is an open-source, Debian-based Linux distribution geared towards various information security tasks, such as Penetration Testing, Security Research, Computer Forensics and Reverse Engineering.<br /> <br /> *[https://www.backbox.org/ BlackBox] is more than an operating system, it is a Free Open Source Community Project with the aim of promoting the culture of security in IT environment and give its contribution to make it better and safer.<br /> <br /> *[https://blackarch.org/ BlackArch] - is an Arch Linux-based penetration testing distribution for penetration testers and security researchers.<br /> <br /> *[https://www.parrotsec.org/ Parrot Security] - is based on top of Debian, the most advanced and recognized universal operating system that can run anywhere.<br /> <br /> *[https://labs.fedoraproject.org/security/ Fedora Security Spin] - is a live media based on Fedora to provide a safe test environment for working on security auditing, forensics and penetration testing, coupled with all the Fedora Security features and tools.<br /> <br /> *[https://www.caine-live.net/ CAINE] - CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution created as a Digital Forensics project.<br /> <br /> *[https://github.com/dracos-linux Dracos Linux] - is the Linux operating system from Indonesia, open source is built based on Debian live project under the protection of the GNU General Public License v3.0. This operating system is one variant of Linux distributions, which is used to perform security testing (penetration testing). Dracos linux in Arm by hundreds hydraulic pentest, forensics and reverse engineering.<br /> <br /> *[https://www.pentoo.ch/ Pentoo] - is a Live CD and Live USB designed for penetration testing and security assessment. Based off Gentoo Linux, Pentoo is provided both as 32 and 64 bit installable livecd.<br /> <br /> ====Privacy Operating System====<br /> <br /> *[https://tails.net/ Tails] - is a portable operating system that protects against surveillance and censorship.<br /> <br /> <br /> ----<br /> <br /> ====Tools for opening CAD or Boardview files====<br /> '''Description''': Boardview is a type of file containing information about printed circuit boards, their components, used signals, test points and more. These files may have following extensions: .asc, .bdv, .brd, .bv, .cad, .cst, .gr, .f2b, .fz, .tvw and others.<br /> <br /> *[https://pldaniels.com/flexbv5/ FlexBV] - Advanced FlexBV boardview software integrates your boardview files with PDF schematics to substantially ease the process of tracking down faults and understanding damaged boards<br /> <br /> *[http://boardviewer.net/ BoardViewer] - BoardViewer is software intended for viewing various boardview file types<br /> <br /> *CADview - simple old tool for viewing CAD files of PCB's. [[File:CAD View.zip|thumb]] [https://www.virustotal.com/gui/file/9a64621ff34d8d674ba6580538908f4ea170fee9cc1cb700485bd41e3a3a42df VT link]<br /> <br /> For resources to open in your favorite boardview program visit <br /> [[Literature#Datasheets_boardviews_.26_schematics|Literature -&gt; 1.2 Datasheets boardviews &amp; schematics]]<br /> <br /> ==Education==<br /> Tools are great, and sometimes free! Without knowing how to use them, they can be a big waste of time. Better to spend your time learning the basics, then apply your knowledge. <br /> <br /> [https://github.com/mytechnotalent/Reverse-Engineering-Tutorial Reverse Engineering Tutorial] - A comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM &amp; 64-bit ARM architectures.</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_A3100_IS&diff=2036 Canon PowerShot A3100 IS 2023-10-09T00:40:15Z <p>Chicken: </p> <hr /> <div>Teardown of the Canon PowerShot A3100 IS point-and-shoot camera.<br /> <br /> 12.1 MP, 1/2.3&quot; CCD sensor, optical image stabilizer. Released in January 2010. PCB date code is 3rd week of 2010.<br /> [[File:Canon PowerShot A3100 IS.jpg|none|thumb|Canon PowerShot A3100 IS]]<br /> The teardown subject was dead, with missing battery, and won't power on when 3.7V is applied to the battery terminals.<br /> <br /> Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/A3100IS CHDK Wiki].<br /> <br /> No service manual found.<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot A3100 IS Main Front.jpg|none|thumb|Main PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS Main Back.jpg|none|thumb|Main PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS buttons front.jpg|none|thumb|Button PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS buttons back.jpg|none|thumb|Button PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS sd card front.jpg|none|thumb|SD card PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS sd back.jpg|none|thumb|SD card PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS ccd front.jpg|none|thumb|CCD sensor, top view]]<br /> [[File:Canon PowerShot A3100 IS ccd sensor back.jpg|none|thumb|CCD sensor and lens assembly, bottom view]]<br /> <br /> ==Parts Identification==<br /> The parts are grouped based on (guessed) functional blocks.<br /> <br /> ===CPU/DSP===<br /> Canon '''DIGIC III''' <br /> <br /> *Main SoC<br /> *Marking CK4-1127 E142C2 Z55<br /> <br /> Samsung '''K8P6415UQB''' 4Mx16 NOR Flash Memory, 16 MB<br /> <br /> Elpida '''D51321DBH-6ETS-F''' 16Mx32 DDR333 Mobile RAM, 64 MB<br /> <br /> '''351-9K3''' 8-pin package RTC? (near 32k crystal)<br /> <br /> ===CCD Driver===<br /> Analog Devices '''DI9004''' (also found in Sanyo VPC-S1415)<br /> <br /> *Marking: BBCZ #1008 1808576.1<br /> *CCD frontend w/ ADC and likely also timing generator<br /> <br /> ===Audio/Video===<br /> Sanyo '''LA74310LP''' Audio Interface and Video Driver<br /> <br /> *Marking A74310 0PX0<br /> <br /> ===Lens/Image Stabilization===<br /> Renesas '''R2J30507''' 01110B optical image stabilization driver<br /> <br /> *Similar IC in Sony W120, Canon PowerShot G9<br /> <br /> 2x Murata '''ENC-03''' series, angular rate sensors (SE501/SE502)<br /> <br /> *Probably 1x ENC-03RC-R and 1x ENC-03RD-R<br /> *Similar to Sony W120, Canon PowerShot G9<br /> <br /> ===Power===<br /> Maxim '''8680CE''' TL005 7 Channel DC-DC Power Management IC<br /> <br /> ===Flash===<br /> TI '''TPS65560''' Flash charger and IGBT driver<br /> <br /> *Chip marking: BPR TI 01 A2DI<br /> *Also in Sony W55 and W120<br /> <br /> Renesas '''RJP4002ASA''' IGBT<br /> [[File:Canon PowerShot A3100 IS debug connector.jpg|thumb|Unpopulated connector, likely with JTAG and UART]]<br /> <br /> ==Hacking==<br /> Unpopulated connector located on back of board<br /> <br /> *Candidate for JTAG and debug UART<br /> *Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF <br /> &lt;/syntaxhighlight&gt;&lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=2034 Canon PowerShot G9 2023-10-09T00:02:18Z <p>Chicken: moved description of JTAG/UART connector to Hacking section</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP, 1/1.7&quot; CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> <br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial? (see below)<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]<br /> <br /> == Hacking ==<br /> Unpopulated connector CN1003 located on back of main board<br /> <br /> * Candidate for JTAG and/or UART<br /> * Located near to SD card holder<br /> * Multiple pads connected to test points<br /> * Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF -<br /> &lt;/syntaxhighlight&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=User:Chicken&diff=2033 User:Chicken 2023-10-08T23:52:25Z <p>Chicken: add link to teardown of Canon A3100 IS</p> <hr /> <div>I reverse engineer out of curiosity and stubbornness. Addicted to consumer cameras and all things [[wikipedia:Automatic_identification_system|AIS]]. <br /> <br /> ===My Teardowns on Recessim===<br /> [[Canon PowerShot G9]]<br /> <br /> [[Canon PowerShot A3100 IS]]<br /> <br /> [[Disney Flix Camcorder]]<br /> <br /> ===My Reverse Engineering Projects===<br /> Reverse engineering of the internals of the Silabs [https://www.silabs.com/wireless/proprietary/ezradiopro-sub-ghz-ics EZRadioPRO] family of ISM radios, including an 8051, firmware patches, and docs hidden inside the vendor software.<br /> <br /> https://github.com/astuder/Inside-EZRadioPRO<br /> <br /> Teardowns &amp; analysis of a few AIS receivers:<br /> <br /> SRT Marine Krypton: https://mstdn.social/@adistuder/110210851234578384<br /> <br /> Matsutec AR-10: https://mstdn.social/@adistuder/110029304514959479<br /> <br /> Fixing (reviving) the deprecated maps module in Adobe Lightroom Classic. Involved reverse engineering and patching LUA executables.<br /> <br /> https://github.com/astuder/lightroom-map-fix<br /> <br /> PPLD, a decompiler for PCBoard PPEs that I wrote many moons ago. PPEs were plugins for the once popular BBS software [[wikipedia:PCBoard|PCBoard]].<br /> <br /> https://github.com/astuder/ppld<br /> <br /> ===Socials===<br /> GitHub: [https://github.com/astuder astuder]<br /> <br /> Twitter: [https://twitter.com/AdiStuder @adistuder]<br /> <br /> Mastodon: [https://mstdn.social/@adistuder @adistuder@mstdn.social]<br /> <br /> Discord: adistuder<br /> <br /> Send me a message on any of the above if you see an IC in my teardowns that you'd like to bath in acid and/or image at a higher resolution.</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_A3100_IS&diff=2032 Canon PowerShot A3100 IS 2023-10-08T23:51:02Z <p>Chicken: Created page with &quot;Teardown of the Canon PowerShot A3100 IS point-and-shoot camera. 12.1 MP, 1/2.3&quot; CCD sensor, optical image stabilizer. Released in January 2010. PCB date code is 3rd week of...&quot;</p> <hr /> <div>Teardown of the Canon PowerShot A3100 IS point-and-shoot camera.<br /> <br /> 12.1 MP, 1/2.3&quot; CCD sensor, optical image stabilizer. Released in January 2010. PCB date code is 3rd week of 2010.<br /> [[File:Canon PowerShot A3100 IS.jpg|none|thumb|Canon PowerShot A3100 IS]]<br /> The teardown subject was dead, with missing battery, and won't power on when 3.7V is applied to the battery terminals.<br /> <br /> Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/A3100IS CHDK Wiki].<br /> <br /> No service manual found.<br /> <br /> == Teardown Pictures ==<br /> [[File:Canon PowerShot A3100 IS Main Front.jpg|none|thumb|Main PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS Main Back.jpg|none|thumb|Main PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS buttons front.jpg|none|thumb|Button PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS buttons back.jpg|none|thumb|Button PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS sd card front.jpg|none|thumb|SD card PCB, top view]]<br /> [[File:Canon PowerShot A3100 IS sd back.jpg|none|thumb|SD card PCB, bottom view]]<br /> [[File:Canon PowerShot A3100 IS ccd front.jpg|none|thumb|CCD sensor, top view]]<br /> [[File:Canon PowerShot A3100 IS ccd sensor back.jpg|none|thumb|CCD sensor and lens assembly, bottom view]]<br /> <br /> == Parts Identification ==<br /> The parts are grouped based on (guessed) functional blocks.<br /> <br /> === CPU/DSP ===<br /> Canon '''DIGIC III''' <br /> <br /> * Main SoC<br /> * Marking CK4-1127 E142C2 Z55<br /> <br /> Samsung '''K8P6415UQB''' 4Mx16 NOR Flash Memory, 16 MB<br /> <br /> Elpida '''D51321DBH-6ETS-F''' 16Mx32 DDR333 Mobile RAM, 64 MB<br /> <br /> '''351-9K3''' 8-pin package RTC? (near 32k crystal)<br /> <br /> === CCD Driver ===<br /> Analog Devices '''DI9004''' (also found in Sanyo VPC-S1415)<br /> <br /> * Marking: BBCZ #1008 1808576.1<br /> * CCD frontend w/ ADC and likely also timing generator<br /> <br /> === Audio/Video ===<br /> Sanyo '''LA74310LP''' Audio Interface and Video Driver<br /> <br /> * Marking A74310 0PX0<br /> <br /> === Lens/Image Stabilization ===<br /> LG (Renesas?) '''R2J30507''' 01110B optical image stabilization driver<br /> <br /> * Similar IC in Sony W120, Canon PowerShot G9<br /> <br /> 2x Murata '''ENC-03''' series, angular rate sensors (SE501/SE502)<br /> <br /> * Probably 1x ENC-03RC-R and 1x ENC-03RD-R<br /> * Similar to Sony W120, Canon PowerShot G9<br /> <br /> === Power ===<br /> Maxim '''8680CE''' TL005 7 Channel DC-DC Power Management IC<br /> <br /> === Flash ===<br /> TI '''TPS65560''' Flash charger and IGBT driver<br /> <br /> * Chip marking: BPR TI 01 A2DI<br /> * Also in Sony W55 and W120<br /> <br /> Renesas '''RJP4002ASA''' IGBT<br /> [[File:Canon PowerShot A3100 IS debug connector.jpg|thumb|Unpopulated connector, likely with JTAG and UART]]<br /> <br /> == Hacking ==<br /> Unpopulated connector located on back of board<br /> <br /> * Candidate for JTAG and debug UART<br /> * Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF <br /> &lt;/syntaxhighlight&gt;&lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_debug_connector.jpg&diff=2031 File:Canon PowerShot A3100 IS debug connector.jpg 2023-10-08T23:48:15Z <p>Chicken: </p> <hr /> <div>Unpopulated connector on Canon PowerShot A3100 IS, likely for JTAG and serial debug</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_ccd_sensor_back.jpg&diff=2030 File:Canon PowerShot A3100 IS ccd sensor back.jpg 2023-10-08T23:38:48Z <p>Chicken: </p> <hr /> <div>Back-side view of CCD sensor of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_ccd_front.jpg&diff=2029 File:Canon PowerShot A3100 IS ccd front.jpg 2023-10-08T23:37:32Z <p>Chicken: </p> <hr /> <div>Front view of ccd sensor of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_sd_back.jpg&diff=2028 File:Canon PowerShot A3100 IS sd back.jpg 2023-10-08T23:36:13Z <p>Chicken: </p> <hr /> <div>Back-side view of SD card PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_sd_card_front.jpg&diff=2027 File:Canon PowerShot A3100 IS sd card front.jpg 2023-10-08T23:35:08Z <p>Chicken: </p> <hr /> <div>Front view of SD card PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_buttons_back.jpg&diff=2026 File:Canon PowerShot A3100 IS buttons back.jpg 2023-10-08T23:33:42Z <p>Chicken: </p> <hr /> <div>Backside view of button PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_buttons_front.jpg&diff=2025 File:Canon PowerShot A3100 IS buttons front.jpg 2023-10-08T23:32:36Z <p>Chicken: </p> <hr /> <div>Front view of button PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_Main_Back.jpg&diff=2024 File:Canon PowerShot A3100 IS Main Back.jpg 2023-10-08T23:31:02Z <p>Chicken: </p> <hr /> <div>Back-side view of main PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS_Main_Front.jpg&diff=2023 File:Canon PowerShot A3100 IS Main Front.jpg 2023-10-08T23:29:37Z <p>Chicken: </p> <hr /> <div>Front view of main PCB of Canon PowerShot A3100 IS</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_A3100_IS.jpg&diff=2022 File:Canon PowerShot A3100 IS.jpg 2023-10-08T23:25:19Z <p>Chicken: </p> <hr /> <div>Canon PowerShot A3100 IS camera</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=2021 Canon PowerShot G9 2023-10-08T23:20:09Z <p>Chicken: </p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP, 1/1.7&quot; CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|CN1003, a candidate for JTAG and/or serial debug]]<br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> *Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].&lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF -<br /> &lt;/syntaxhighlight&gt;<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=2020 Canon PowerShot G9 2023-10-08T22:09:35Z <p>Chicken: added link to CHDK Wiki</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|CN1003, a candidate for JTAG and/or serial debug]]<br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> *Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].&lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF -<br /> &lt;/syntaxhighlight&gt;<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1926 Canon PowerShot G9 2023-10-05T23:45:41Z <p>Chicken: /* Parts Identification */ add JTAG/UART pinout</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|CN1003, a candidate for JTAG and/or serial debug]]<br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> *Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].&lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> TX - _ RX<br /> GND - _ 3.3V<br /> SHDN - _ N/C<br /> N/C - _ HALF_BAUD<br /> PD - _ ALT_BOOT<br /> PD - _ /TRST<br /> TDI - _ TMS<br /> TCK - _ TDO<br /> /OFF -<br /> &lt;/syntaxhighlight&gt;<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1925 Canon PowerShot G9 2023-10-05T23:43:18Z <p>Chicken: /* CPU/DSP */ add link blog post about finding JTAG/UART on Canon camera</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|CN1003, a candidate for JTAG and/or serial debug]]<br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> *Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=User:Chicken&diff=1924 User:Chicken 2023-10-04T18:12:22Z <p>Chicken: </p> <hr /> <div>I reverse engineer out of curiosity and stubbornness. Addicted to consumer cameras and all things [[wikipedia:Automatic_identification_system|AIS]]. <br /> <br /> ===My Teardowns on Recessim===<br /> [[Canon PowerShot G9]]<br /> <br /> [[Disney Flix Camcorder]]<br /> <br /> ===My Reverse Engineering Projects===<br /> Reverse engineering of the internals of the Silabs [https://www.silabs.com/wireless/proprietary/ezradiopro-sub-ghz-ics EZRadioPRO] family of ISM radios, including an 8051, firmware patches, and docs hidden inside the vendor software.<br /> <br /> https://github.com/astuder/Inside-EZRadioPRO<br /> <br /> Teardowns &amp; analysis of a few AIS receivers:<br /> <br /> SRT Marine Krypton: https://mstdn.social/@adistuder/110210851234578384<br /> <br /> Matsutec AR-10: https://mstdn.social/@adistuder/110029304514959479<br /> <br /> Fixing (reviving) the deprecated maps module in Adobe Lightroom Classic. Involved reverse engineering and patching LUA executables.<br /> <br /> https://github.com/astuder/lightroom-map-fix<br /> <br /> PPLD, a decompiler for PCBoard PPEs that I wrote many moons ago. PPEs were plugins for the once popular BBS software [[wikipedia:PCBoard|PCBoard]].<br /> <br /> https://github.com/astuder/ppld<br /> <br /> ===Socials===<br /> GitHub: [https://github.com/astuder astuder]<br /> <br /> Twitter: [https://twitter.com/AdiStuder @adistuder]<br /> <br /> Mastodon: [https://mstdn.social/@adistuder @adistuder@mstdn.social]<br /> <br /> Discord: adistuder<br /> <br /> Send me a message on any of the above if you see an IC in my teardowns that you'd like to bath in acid and/or image at a higher resolution.</div> Chicken https://wiki.recessim.com/w/index.php?title=User:Chicken&diff=1923 User:Chicken 2023-10-04T18:11:53Z <p>Chicken: added note</p> <hr /> <div>I reverse engineer out of curiosity and stubbornness. Addicted to consumer cameras and all things [[wikipedia:Automatic_identification_system|AIS]]. <br /> <br /> ===My Teardowns on Recessim===<br /> [[Canon PowerShot G9]]<br /> <br /> [[Disney Flix Camcorder]]<br /> <br /> ===My Reverse Engineering Projects===<br /> Reverse engineering of the internals of the Silabs [https://www.silabs.com/wireless/proprietary/ezradiopro-sub-ghz-ics EZRadioPRO] family of ISM radios, including an 8051, firmware patches, and docs hidden inside the vendor software.<br /> <br /> https://github.com/astuder/Inside-EZRadioPRO<br /> <br /> Teardowns &amp; analysis of a few AIS receivers:<br /> <br /> SRT Marine Krypton: https://mstdn.social/@adistuder/110210851234578384<br /> <br /> Matsutec AR-10: https://mstdn.social/@adistuder/110029304514959479<br /> <br /> Fixing (reviving) the deprecated maps module in Adobe Lightroom Classic. Involved reverse engineering and patching LUA executables.<br /> <br /> https://github.com/astuder/lightroom-map-fix<br /> <br /> PPLD, a decompiler for PCBoard PPEs that I wrote many moons ago. PPEs were plugins for the once popular BBS software [[wikipedia:PCBoard|PCBoard]].<br /> <br /> https://github.com/astuder/ppld<br /> <br /> ===Socials===<br /> GitHub: [https://github.com/astuder astuder]<br /> <br /> Twitter: [https://twitter.com/AdiStuder @adistuder]<br /> <br /> Mastodon: [https://mstdn.social/@adistuder @adistuder@mstdn.social]<br /> <br /> Discord: adistuder<br /> <br /> Send me a message on any of these if you see an IC in my teardowns that you'd like to bath in acid and/or image at a higher resolution.</div> Chicken https://wiki.recessim.com/w/index.php?title=Disney_Flix_Camcorder&diff=1921 Disney Flix Camcorder 2023-10-02T04:01:20Z <p>Chicken: typos</p> <hr /> <div>[[File:Disney Flix Camcorder.jpg|none|thumb|Disney Flix Camcorder, ~2007 vintage]]<br /> Surprisingly, this toy camcorder made for an interesting teardown.<br /> <br /> Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach in the late 2000s to early 2010s was the dominant camera SoC, found in many consumer point &amp; shoot cameras. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who then later sold off its camera IP to Qualcomm.<br /> <br /> The camera is also unique, in that it isn't a rats nest of flat flex cables, but mostly uses right-angle pin-headers as interconnect between circuit boards (the exception being the display). This will make it easy to tap into signals between image sensor and SoC, or to automate camera controls with an MCU.<br /> <br /> ==Teardown pictures==<br /> [[File:Disney Flix Camcorder Main PCB Front.jpg|none|thumb|Main PCB, front]]<br /> &lt;br /&gt;<br /> [[File:Disney Flix Camcorder Main PCB back.jpg|none|thumb|Main PCB, back]]<br /> [[File:Disney Flix Camcorder Sensor PCB Front.jpg|none|thumb|Sensor PCB, front]]<br /> [[File:Disney Flix Sensor PCB back.jpg|none|thumb|Sensor PCB, back]]<br /> [[File:Disney Flix Camcorder Controls PCB front.jpg|none|thumb|Controls PCB, front]]<br /> [[File:Disney Flix Camcorder Controls PCB Back.jpg|none|thumb|Controls PCB, back]]<br /> [[File:Disney Flix Camcorder Display PCB back.jpg|none|thumb|Display PCB, back]]<br /> [[File:Disney Flix Camcorder Construction.jpg|none|thumb|Assembled camera, without enclosure. Note the pin-header interconnects.]]<br /> <br /> ==Parts identification==<br /> <br /> ===Main PCB===<br /> U1 Zoran '''ZR36440BGCF''' Coach 6e Digital Camera Processor<br /> <br /> U3 Elpida '''S6416GHTA-10-E''' 4Mx16b (8MB) SDRAM <br /> <br /> U4 Hynix '''HY27US08121A''' 64Mx8b NAND Flash (under SD Card slot)<br /> <br /> U251 Holtek '''HT82V735''' 330mW Stereo Audio Power Amp<br /> <br /> U302 marking '''DE-K1L''', SOT-23-5 LDO?<br /> <br /> U??? '''m'''arking '''DC-U06''', SOT-23-5 LDO?<br /> <br /> U??? marking '''D A- 9JS2Q''', 6-pin package, Boost Converter?<br /> <br /> J1 debug header (see below)<br /> <br /> ===Sensor PCB===<br /> U? Silicon Optronics Inc. '''SOI-968''' image sensor<br /> <br /> *1.3MPixel (SXGA), CMOS<br /> *Datasheet [https://web.archive.org/web/20231002032056/http://file1.dzsc.com/product/13/05/14/854235_135052437.pdf available]<br /> <br /> U? JRC '''NJM4580M''' dual audio op amp<br /> <br /> *Likely for microphone and/or audio jack on same board<br /> <br /> ===Display===<br /> Marking on flatflex: Tp037A<br /> <br /> Boot message: LCD = TOPPLY_TP033B<br /> <br /> ==Serial debug port==<br /> A serial debug port is available on four pads marked as J1:<br /> <br /> UART parameters: 115200 8N1<br /> <br /> Pinout (starting at J1 label): 3.3V, TX, RX, GND<br /> <br /> ===Logs===<br /> <br /> ====Boot====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Boot - VER: HW=0x62B0, FW=0x0463.19<br /> CODE = 1042192 byte, DATA = 52888 byte<br /> THR - Z2c Writer<br /> LCD = TOPPLY_TP033B<br /> CODEC = AVC<br /> THR2 - HCE<br /> RESIDENT = NAND (SR)<br /> CARD = SD<br /> RES A - OK<br /> RES B - OK<br /> RES C - OK<br /> THR2 - AgentServer<br /> THR2 - StillServer<br /> THR2 - BrowseServer<br /> MON&gt; THR2 - Monitor<br /> ÿCTLut - 92x85<br /> Hce proc started<br /> HceOnCreate<br /> HceOnCreate Create Element<br /> HceOnCreate_SD<br /> <br /> ##### Msg handled by General: [0500][00000000]-[CREATE] #####<br /> HceOnCreate_SD<br /> AgentOnSetMsMedia<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;HceOnMsg: FlashCardDetect = 0<br /> Next St = 1HceOnCreate_WaitIdle<br /> <br /> ##### Msg handled by Quene: [0700][00000000]-[FLASH_CARD_DETECT] #####<br /> HceOnCreate_WaitIdle<br /> Next St = 2ADC0 Value is 31<br /> HCE_ReadFGPIOButtons 0x01<br /> &gt;&gt;##&gt;&gt;## init capture key = 1<br /> SENSOR - SOI968<br /> !Kenny SOI968 sensor<br /> Init RTC<br /> HCE_InitOptions<br /> HCE_ChkUSPExist USP.bin Exist!!<br /> <br /> B:\USP.BIN restored successfully.<br /> Do Nothing<br /> END<br /> Hce_SetFlickerFormat[1]<br /> AeSetAgcMode 1<br /> AeSetAeMode 1<br /> AeSetPreviewExpLimit 45 127<br /> AeSetCaptureExpLimit 45 127 255 255<br /> 0:(235,399)<br /> 1:(234,413)<br /> 2:(300,371)<br /> 3:(318,281)<br /> 4:(318,281)<br /> R(234,318) B(281,413)<br /> ulAwbLutSize(Gr,Gb) = (40,46)<br /> I43_SetImageSize - OK<br /> StillOnSetCompressionRatio<br /> AeSetExpDeviation 16<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> StillOnIsspuLs 0<br /> StillOnIsspuClpf 1<br /> StillOnIsspuLc 0<br /> <br /> **MountStorageMedia type = 0 **<br /> I43_MountStorageMedia - 0<br /> AgentOnSetMsMedia<br /> :::HCE::: Media Mounted Success<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> <br /> ## refresh photo num is true ##<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> uAviSecondsRemain[90] ulSpaceLeft[41615360]<br /> uMovieMinSize[540672]uMovieSizeParam[451730]<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> <br /> load ASDUI.bin<br /> GdiLoadFont - \UI.BIN<br /> <br /> init osd clut<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt; HceOsd: Init - OSD<br /> <br /> init font color &amp; size<br /> <br /> ## HCE_PAviInit ##<br /> <br /> ## HCE_PAudio Init ##<br /> <br /> &gt;&gt;&gt; init ClockCheck<br /> HCE_InitClockCheck<br /> LCD = TOPPLY_TP033B<br /> HceDlcdSetPins<br /> Send Reg. Th to TP051!!<br /> TopplyDlcdInit ...<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt; HceLcd.c: LCD mode<br /> LCDON<br /> GPIO_LCDONOFF =1MOFF<br /> BATTERY STABLE [172]<br /> AppSetMode 0x30 -1<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> ADC0 Value is 31<br /> Read ADC1 Button 31<br /> HCE_ReadFGPIOButtons 0x01<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> XLGPIO pressed is 6<br /> <br /> ##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####<br /> AgentOnUsbConnect<br /> THR - UsbAgent<br /> THR - CmdDispatcher<br /> NextMode: 6, ThIdle: 1<br /> Usb Agent: Disconnect Event<br /> 2 NextMode: 6, ThIdle: 1<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> AsdMode_ChgModeDesed Create Element<br /> HCE_AviConstructor<br /> HCE_AviConstructor Create Element<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; ModeAvi.c: Setting Avi mode<br /> BrowseOnSetAudioCompression 1<br /> Video image size 640 480<br /> I43_SetImageSize - OK<br /> Video image size 640 480<br /> I43_SetImageSize - OK<br /> StillOnSetCompressionRatio<br /> StillOnSetRecordingTime 65535<br /> BrowseOnSetRecordingTime 65535<br /> AeSetExpDeviation 16<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> AeSetAgcMode 1<br /> AeSetAeMode 1<br /> <br /> **MountStorageMedia type = 0 **<br /> I43_MountStorageMedia - 0<br /> AgentOnSetMsMedia<br /> :::HCE::: Media Mounted Success<br /> AppSetMode 0x40 -1<br /> StillOnActive -1<br /> THR - Store<br /> THR - FileCreator<br /> THR - Aaa<br /> AAA start.<br /> Go to view mode!!!StillOnModeStart 3 -&gt; 0<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillPreviewActive<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillStartMode 0 0<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillPreviewStart<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> THR - PreviewMode<br /> <br /> ##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####<br /> StillPreviewMain<br /> THR - Sensor<br /> <br /> ##### Msg handled by General and Queue: [0800][00000040]-[NEW_MODE] #####<br /> THR - StatAe<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> _ASDM_ST_CUR_MODEID 6<br /> HceOsdDrawBattery level 4<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ====Power down====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> HCE_ReadFGPIOButtons 0x01<br /> ##### Msg handled by General: [5100][00000000]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> NextMode: 1, ThIdle: 1<br /> 2 NextMode: 1, ThIdle: 1<br /> HceSetSwitchWorkMode WorkModeId: 1Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> HCE_AviDestructor<br /> HCE_AviDestructor Create Element<br /> AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 0<br /> StillOnActive 0<br /> StillOnModeEnd 0. Next mode is 0<br /> StillPreviewStop<br /> StillAbort<br /> AWB stats aborted in the middle of transaction.<br /> AAA process terminating !!!<br /> StillOnAaaExit<br /> StillOnStoreExit<br /> StillOnFileCreateExit<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> HCE_PowerOff()<br /> MOFF<br /> GPIO_LCDONOFF =1HCE_PowerOff() 2<br /> Save Param<br /> HCE_SaveOptions<br /> USP saved successfully.<br /> END<br /> Set Display<br /> LCDOFF<br /> MON<br /> GPIO_LCDONOFF =0<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ====Image capture====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> XLGPIO pressed is 4<br /> <br /> ##### Msg handled by General: [5000][00000004]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> bEnableCapture: 1Capture is just pressed<br /> TaskStill_CapImage Create Element<br /> HceWave_PlyByEnum a:\wave\Still\shutter.wav<br /> BrowseAudioStart<br /> THR - Browse Audio<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Audio Openned:<br /> AVC Codec: Rate - 8000, Compression - 1, Channels - 1<br /> File: Rate - 8000, Compression - 1, Channels - 1<br /> THR - AudioProc<br /> <br /> ##### Msg not handled: [1b00][00000001]-[VALID_AUDIO] #####<br /> THR - AudioCodecPlay<br /> AVC Enable()<br /> XLGPIO pressed is 6<br /> <br /> ##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> carson -- TX_QUEUE_EMPTY<br /> AppSetMode 0x50 0<br /> <br /> ##### Msg handled by Quene: [6100][00000000]-[WAV_OPERATION_COMPLETE] #####<br /> StillOnModeStart 0 -&gt; 1<br /> StillOnModeEnd 0. Next mode is 1<br /> StillStartMode 1 0<br /> THR - CaptureMode<br /> <br /> ##### Msg handled by General and Queue: [0800][00000050]-[NEW_MODE] #####<br /> AE stats aborted in the middle of transaction.<br /> THR - Sensor<br /> THR - Sensor<br /> <br /> ##### Msg handled by Quene: [5d00][00000000]-[CAPTURE_RAW_READY] #####<br /> THR - StatAe<br /> <br /> ##### Msg handled by General: [0800][00000080]-[NEW_MODE] #####<br /> <br /> ##### Msg not handled: [6500][00000000]-[SEND_CONFIRM_STORE] #####<br /> I43_ConfirmStore - 1<br /> StillOnModeEnd 1. Next mode is 0<br /> StillStartMode 0 0<br /> StillPreviewStart<br /> THR - PreviewMode<br /> Ray ---------------Light Source is 255<br /> StillPreviewMain<br /> <br /> ##### Msg handled by General: [0800][00000040]-[NEW_MODE] #####<br /> Actual file size - 180696<br /> <br /> ##### Msg not handled: [1400][00000000]-[STORE_BEGIN] #####<br /> <br /> ##### Msg not handled: [5c00][00000000]-[DISPLAY_WINDOW_COMLETE] #####<br /> Store time is 0.66 seconds (0.25 MB/sec)<br /> Store Done<br /> <br /> ##### Msg not handled: [1600][00000000]-[BKG_STORE_COMPLETE] #####<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> HceOsdDrawBattery level 4<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> Total Pic 5<br /> Pic Left230<br /> <br /> ##### Msg handled by Quene: [6c00][00000000]-[STORE_FINISHED] #####<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ====View image====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> ModeThumbnails_ThumNavGst 2<br /> NextMode: 3, ThIdle: 1<br /> 2 NextMode: 3, ThIdle: 1<br /> <br /> ##### Msg handled by General and Queue: [0100][00000100]-[USER] #####<br /> ModeThumbnails_ThumNavGst 2<br /> AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 1<br /> BrowseOnActive<br /> BrowseEndMode<br /> BrowseIndexEnd<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> ModePlayback_PlyBckConst Create Element<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; ModePlayback.c: Setting Playback mode<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> ModePlayback_RstCurImg Create Element<br /> MsgH_SetCurEleDGst 3<br /> I43_GetDCFInfo<br /> I43_GetFileAttributes - OK<br /> AppSetMode 0x90 -1<br /> BrowseOnActive<br /> <br /> ##### Msg handled by General: [0100][00000000]-[USER] #####<br /> BrowseOnModeStart<br /> BrowseEndMode<br /> BrowseImageStart<br /> THR - Image<br /> <br /> ##### Msg handled by General and Queue: [0800][00000090]-[NEW_MODE] #####<br /> <br /> ##### Msg handled by Quene: [1a00][00000001]-[VALID_IMAGE] #####<br /> Read ADC1 Button 31<br /> ModePlayback_RstCurImgEnd<br /> BrowseOnModeEnd<br /> MsgH_SetCurEleDGst 0<br /> Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]<br /> <br /> ## jpeg file ##<br /> HceOsdDrawBattery level 4<br /> <br /> ##### Msg handled by General and Queue: [0800][000000c0]-[NEW_MODE] #####<br /> Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]<br /> <br /> ## jpeg file ##<br /> HceOsdDrawBattery level 4<br /> <br /> ##### Msg handled by General: [0100][00000000]-[USER] #####<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ====Change mode to &quot;Settings&quot;====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> HCE_ReadFGPIOButtons 0x04<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> HCE_ReadFGPIOButtons 0x05<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> NextMode: 7, ThIdle: 1<br /> 2 NextMode: 7, ThIdle: 1<br /> HceSetSwitchWorkMode WorkModeId: 7AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 1<br /> BrowseOnActive<br /> BrowseEndMode<br /> BrowseMenuEnd<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> HCE_SetupMenuConstructor Create Element<br /> AppSetMode 0x0 -1<br /> BrowseOnActive<br /> Go to Menu mode!!!BrowseOnModeStart<br /> BrowseEndMode<br /> BrowseOnModeEnd<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt; MNU_SetupListConstr<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> Draw Jpeg [A:\JPEG\BRI_Y.JPG]<br /> Draw Jpeg [A:\JPEG\AON_W.JPG]<br /> Draw Jpeg [A:\JPEG\S3M_W.JPG]<br /> Draw Jpeg [A:\JPEG\DTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\NTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\F60_W.JPG]<br /> Draw Jpeg [A:\JPEG\LEN_W.JPG]<br /> Draw Jpeg [A:\JPEG\VER_W.JPG]<br /> Draw Jpeg [A:\JPEG\DEF_W.JPG]<br /> <br /> ##### Msg handled by General and Queue: [0800][00000000]-[NEW_MODE] #####<br /> &lt;/syntaxhighlight&gt;Set volume to &quot;Low&quot;&lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Read ADC1 Button 2<br /> Right Pressed<br /> Draw Jpeg [A:\JPEG\BRI_W.JPG]<br /> <br /> ## passed jpeg no. = 16 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> Move MENU_CURITEM 1<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> _ASDM_ST_CUR_MODEID 7<br /> *************HCE_DrawSubMenuTitle uStartX 212, uStartY 18<br /> <br /> ## jpeg index = 16 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> uStartX,376 uStartY,190 uStartW,300 w,57<br /> wreal 82<br /> uStartX,376 uStartY,280 uStartW,300 w,53<br /> wreal 77<br /> uStartX,376 uStartY,370 uStartW,300 w,44<br /> wreal 64<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 5<br /> Down Pressed<br /> <br /> ## jpeg index = 17 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> uStartX,376 uStartY,190 uStartW,300 w,57<br /> wreal 82<br /> uStartX,376 uStartY,280 uStartW,300 w,53<br /> wreal 77<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> HCE_SaveOptions<br /> USP saved successfully.<br /> END<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt; MNU_SetupListConstr<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> Draw Jpeg [A:\JPEG\BRI_W.JPG]<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> Draw Jpeg [A:\JPEG\S3M_W.JPG]<br /> Draw Jpeg [A:\JPEG\DTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\NTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\F60_W.JPG]<br /> Draw Jpeg [A:\JPEG\LEN_W.JPG]<br /> Draw Jpeg [A:\JPEG\VER_W.JPG]<br /> Draw Jpeg [A:\JPEG\DEF_W.JPG]<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> <br /> &lt;/syntaxhighlight&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=User:Chicken&diff=1920 User:Chicken 2023-10-02T03:57:49Z <p>Chicken: added link to Disney Flix teardown</p> <hr /> <div>I reverse engineer out of curiosity and stubbornness. Addicted to consumer cameras and all things [[wikipedia:Automatic_identification_system|AIS]]. <br /> <br /> ===My Teardowns on Recessim===<br /> [[Canon PowerShot G9]]<br /> <br /> [[Disney Flix Camcorder]]<br /> <br /> ===My Reverse Engineering Projects===<br /> Reverse engineering of the internals of the Silabs [https://www.silabs.com/wireless/proprietary/ezradiopro-sub-ghz-ics EZRadioPRO] family of ISM radios, including an 8051, firmware patches, and docs hidden inside the vendor software.<br /> <br /> https://github.com/astuder/Inside-EZRadioPRO<br /> <br /> Teardowns &amp; analysis of a few AIS receivers:<br /> <br /> SRT Marine Krypton: https://mstdn.social/@adistuder/110210851234578384<br /> <br /> Matsutec AR-10: https://mstdn.social/@adistuder/110029304514959479<br /> <br /> Fixing (reviving) the deprecated maps module in Adobe Lightroom Classic. Involved reverse engineering and patching LUA executables.<br /> <br /> https://github.com/astuder/lightroom-map-fix<br /> <br /> PPLD, a decompiler for PCBoard PPEs that I wrote many moons ago. PPEs were plugins for the once popular BBS software [[wikipedia:PCBoard|PCBoard]].<br /> <br /> https://github.com/astuder/ppld<br /> <br /> ===Socials===<br /> GitHub: [https://github.com/astuder astuder]<br /> <br /> Twitter: [https://twitter.com/AdiStuder @adistuder]<br /> <br /> Mastodon: [https://mstdn.social/@adistuder @adistuder@mstdn.social]<br /> <br /> Discord: #adistuder</div> Chicken https://wiki.recessim.com/w/index.php?title=Disney_Flix_Camcorder&diff=1919 Disney Flix Camcorder 2023-10-02T03:53:08Z <p>Chicken: page created</p> <hr /> <div>[[File:Disney Flix Camcorder.jpg|none|thumb|Disney Flix Camcorder, ~2007 vintage]]<br /> Surprisingly, this toy camcorder made for an interesting teardown.<br /> <br /> Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach for a while was the dominant SoC found in many consumer point &amp; shoot cameras of the late 2000s to early 2010s. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who was then later sold off its camera IP to Qualcomm.<br /> <br /> The camera is also unique, in that it isn't a rats nest of flat flex cables, but mostly uses right-angle pin-headers as interconnect between circuit boards (the exception being the display). This will make it easy to tap into signals between image sensor and SoC, or to automate camera controls with an MCU.<br /> <br /> == Teardown pictures ==<br /> [[File:Disney Flix Camcorder Main PCB Front.jpg|none|thumb|Main PCB, front]]<br /> &lt;br /&gt;<br /> [[File:Disney Flix Camcorder Main PCB back.jpg|none|thumb|Main PCB, back]]<br /> [[File:Disney Flix Camcorder Sensor PCB Front.jpg|none|thumb|Sensor PCB, front]]<br /> [[File:Disney Flix Sensor PCB back.jpg|none|thumb|Sensor PCB, back]]<br /> [[File:Disney Flix Camcorder Controls PCB front.jpg|none|thumb|Controls PCB, front]]<br /> [[File:Disney Flix Camcorder Controls PCB Back.jpg|none|thumb|Controls PCB, back]]<br /> [[File:Disney Flix Camcorder Display PCB back.jpg|none|thumb|Display PCB, back]]<br /> [[File:Disney Flix Camcorder Construction.jpg|none|thumb|Assembled camera, without enclosure. Note the pin-header interconnects.]]<br /> <br /> == Parts identification ==<br /> <br /> === Main PCB ===<br /> U1 Zoran '''ZR36440BGCF''' Coach 6e Digital Camera Processor<br /> <br /> U3 Elpida '''S6416GHTA-10-E''' 4Mx16b (8MB) SDRAM <br /> <br /> U4 Hynix '''HY27US08121A''' 64Mx8b NAND Flash (under SD Card slot)<br /> <br /> U251 Holtek '''HT82V735''' 330mW Stereo Audio Power Amp<br /> <br /> U302 marking '''DE-K1L''', SOT-23-5 LDO?<br /> <br /> U??? '''m'''arking '''DC-U06''', SOT-23-5 LDO?<br /> <br /> U??? marking '''D A- 9JS2Q''', 6-pin package, Boost Converter?<br /> <br /> J1 debug header (see below)<br /> <br /> === Sensor PCB ===<br /> U? Silicon Optronics Inc. '''SOI-968''' image sensor<br /> <br /> * 1.3MPixel (SXGA), CMOS<br /> * Datasheet [https://web.archive.org/web/20231002032056/http://file1.dzsc.com/product/13/05/14/854235_135052437.pdf available]<br /> <br /> U? JRC '''NJM4580M''' dual audio op amp<br /> <br /> * Likely for microphone and/or audio jack on same board<br /> <br /> === Display ===<br /> Marking on flatflex: Tp037A<br /> <br /> Boot message: LCD = TOPPLY_TP033B<br /> <br /> == Serial debug port ==<br /> A serial debug port is available on four pads marked as J1:<br /> <br /> UART parameters: 115200 8N1<br /> <br /> Pinout (starting at J1 label): 3.3V, TX, RX, GND<br /> <br /> === Logs ===<br /> <br /> ==== Boot ====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Boot - VER: HW=0x62B0, FW=0x0463.19<br /> CODE = 1042192 byte, DATA = 52888 byte<br /> THR - Z2c Writer<br /> LCD = TOPPLY_TP033B<br /> CODEC = AVC<br /> THR2 - HCE<br /> RESIDENT = NAND (SR)<br /> CARD = SD<br /> RES A - OK<br /> RES B - OK<br /> RES C - OK<br /> THR2 - AgentServer<br /> THR2 - StillServer<br /> THR2 - BrowseServer<br /> MON&gt; THR2 - Monitor<br /> ÿCTLut - 92x85<br /> Hce proc started<br /> HceOnCreate<br /> HceOnCreate Create Element<br /> HceOnCreate_SD<br /> <br /> ##### Msg handled by General: [0500][00000000]-[CREATE] #####<br /> HceOnCreate_SD<br /> AgentOnSetMsMedia<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;HceOnMsg: FlashCardDetect = 0<br /> Next St = 1HceOnCreate_WaitIdle<br /> <br /> ##### Msg handled by Quene: [0700][00000000]-[FLASH_CARD_DETECT] #####<br /> HceOnCreate_WaitIdle<br /> Next St = 2ADC0 Value is 31<br /> HCE_ReadFGPIOButtons 0x01<br /> &gt;&gt;##&gt;&gt;## init capture key = 1<br /> SENSOR - SOI968<br /> !Kenny SOI968 sensor<br /> Init RTC<br /> HCE_InitOptions<br /> HCE_ChkUSPExist USP.bin Exist!!<br /> <br /> B:\USP.BIN restored successfully.<br /> Do Nothing<br /> END<br /> Hce_SetFlickerFormat[1]<br /> AeSetAgcMode 1<br /> AeSetAeMode 1<br /> AeSetPreviewExpLimit 45 127<br /> AeSetCaptureExpLimit 45 127 255 255<br /> 0:(235,399)<br /> 1:(234,413)<br /> 2:(300,371)<br /> 3:(318,281)<br /> 4:(318,281)<br /> R(234,318) B(281,413)<br /> ulAwbLutSize(Gr,Gb) = (40,46)<br /> I43_SetImageSize - OK<br /> StillOnSetCompressionRatio<br /> AeSetExpDeviation 16<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> StillOnIsspuLs 0<br /> StillOnIsspuClpf 1<br /> StillOnIsspuLc 0<br /> <br /> **MountStorageMedia type = 0 **<br /> I43_MountStorageMedia - 0<br /> AgentOnSetMsMedia<br /> :::HCE::: Media Mounted Success<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> <br /> ## refresh photo num is true ##<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> uAviSecondsRemain[90] ulSpaceLeft[41615360]<br /> uMovieMinSize[540672]uMovieSizeParam[451730]<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> <br /> load ASDUI.bin<br /> GdiLoadFont - \UI.BIN<br /> <br /> init osd clut<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt; HceOsd: Init - OSD<br /> <br /> init font color &amp; size<br /> <br /> ## HCE_PAviInit ##<br /> <br /> ## HCE_PAudio Init ##<br /> <br /> &gt;&gt;&gt; init ClockCheck<br /> HCE_InitClockCheck<br /> LCD = TOPPLY_TP033B<br /> HceDlcdSetPins<br /> Send Reg. Th to TP051!!<br /> TopplyDlcdInit ...<br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt; HceLcd.c: LCD mode<br /> LCDON<br /> GPIO_LCDONOFF =1MOFF<br /> BATTERY STABLE [172]<br /> AppSetMode 0x30 -1<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> ADC0 Value is 31<br /> Read ADC1 Button 31<br /> HCE_ReadFGPIOButtons 0x01<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> XLGPIO pressed is 6<br /> <br /> ##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####<br /> AgentOnUsbConnect<br /> THR - UsbAgent<br /> THR - CmdDispatcher<br /> NextMode: 6, ThIdle: 1<br /> Usb Agent: Disconnect Event<br /> 2 NextMode: 6, ThIdle: 1<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> AsdMode_ChgModeDesed Create Element<br /> HCE_AviConstructor<br /> HCE_AviConstructor Create Element<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; ModeAvi.c: Setting Avi mode<br /> BrowseOnSetAudioCompression 1<br /> Video image size 640 480<br /> I43_SetImageSize - OK<br /> Video image size 640 480<br /> I43_SetImageSize - OK<br /> StillOnSetCompressionRatio<br /> StillOnSetRecordingTime 65535<br /> BrowseOnSetRecordingTime 65535<br /> AeSetExpDeviation 16<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> AeSetAgcMode 1<br /> AeSetAeMode 1<br /> <br /> **MountStorageMedia type = 0 **<br /> I43_MountStorageMedia - 0<br /> AgentOnSetMsMedia<br /> :::HCE::: Media Mounted Success<br /> AppSetMode 0x40 -1<br /> StillOnActive -1<br /> THR - Store<br /> THR - FileCreator<br /> THR - Aaa<br /> AAA start.<br /> Go to view mode!!!StillOnModeStart 3 -&gt; 0<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillPreviewActive<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillStartMode 0 0<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> StillPreviewStart<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> THR - PreviewMode<br /> <br /> ##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####<br /> StillPreviewMain<br /> THR - Sensor<br /> <br /> ##### Msg handled by General and Queue: [0800][00000040]-[NEW_MODE] #####<br /> THR - StatAe<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> HceAviConst_WaitNF<br /> _ASDM_ST_CUR_MODEID 6<br /> HceOsdDrawBattery level 4<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ==== Power down ====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> HCE_ReadFGPIOButtons 0x01<br /> ##### Msg handled by General: [5100][00000000]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> NextMode: 1, ThIdle: 1<br /> 2 NextMode: 1, ThIdle: 1<br /> HceSetSwitchWorkMode WorkModeId: 1Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> HCE_AviDestructor<br /> HCE_AviDestructor Create Element<br /> AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 0<br /> StillOnActive 0<br /> StillOnModeEnd 0. Next mode is 0<br /> StillPreviewStop<br /> StillAbort<br /> AWB stats aborted in the middle of transaction.<br /> AAA process terminating !!!<br /> StillOnAaaExit<br /> StillOnStoreExit<br /> StillOnFileCreateExit<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> Main Power off!!<br /> 2 NextMode: 1, ThIdle: 1<br /> HCE_PowerOff()<br /> MOFF<br /> GPIO_LCDONOFF =1HCE_PowerOff() 2<br /> Save Param<br /> HCE_SaveOptions<br /> USP saved successfully.<br /> END<br /> Set Display<br /> LCDOFF<br /> MON<br /> GPIO_LCDONOFF =0<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ==== Image capture ====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> XLGPIO pressed is 4<br /> <br /> ##### Msg handled by General: [5000][00000004]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> bEnableCapture: 1Capture is just pressed<br /> TaskStill_CapImage Create Element<br /> HceWave_PlyByEnum a:\wave\Still\shutter.wav<br /> BrowseAudioStart<br /> THR - Browse Audio<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Audio Openned:<br /> AVC Codec: Rate - 8000, Compression - 1, Channels - 1<br /> File: Rate - 8000, Compression - 1, Channels - 1<br /> THR - AudioProc<br /> <br /> ##### Msg not handled: [1b00][00000001]-[VALID_AUDIO] #####<br /> THR - AudioCodecPlay<br /> AVC Enable()<br /> XLGPIO pressed is 6<br /> <br /> ##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####<br /> carson -- TX_QUEUE_EMPTY<br /> AppSetMode 0x50 0<br /> <br /> ##### Msg handled by Quene: [6100][00000000]-[WAV_OPERATION_COMPLETE] #####<br /> StillOnModeStart 0 -&gt; 1<br /> StillOnModeEnd 0. Next mode is 1<br /> StillStartMode 1 0<br /> THR - CaptureMode<br /> <br /> ##### Msg handled by General and Queue: [0800][00000050]-[NEW_MODE] #####<br /> AE stats aborted in the middle of transaction.<br /> THR - Sensor<br /> THR - Sensor<br /> <br /> ##### Msg handled by Quene: [5d00][00000000]-[CAPTURE_RAW_READY] #####<br /> THR - StatAe<br /> <br /> ##### Msg handled by General: [0800][00000080]-[NEW_MODE] #####<br /> <br /> ##### Msg not handled: [6500][00000000]-[SEND_CONFIRM_STORE] #####<br /> I43_ConfirmStore - 1<br /> StillOnModeEnd 1. Next mode is 0<br /> StillStartMode 0 0<br /> StillPreviewStart<br /> THR - PreviewMode<br /> Ray ---------------Light Source is 255<br /> StillPreviewMain<br /> <br /> ##### Msg handled by General: [0800][00000040]-[NEW_MODE] #####<br /> Actual file size - 180696<br /> <br /> ##### Msg not handled: [1400][00000000]-[STORE_BEGIN] #####<br /> <br /> ##### Msg not handled: [5c00][00000000]-[DISPLAY_WINDOW_COMLETE] #####<br /> Store time is 0.66 seconds (0.25 MB/sec)<br /> Store Done<br /> <br /> ##### Msg not handled: [1600][00000000]-[BKG_STORE_COMPLETE] #####<br /> HCE_SetWhiteBalance[0]<br /> AwbSetMode 16<br /> HceOsdDrawBattery level 4<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> Total Pic 5<br /> Pic Left230<br /> <br /> ##### Msg handled by Quene: [6c00][00000000]-[STORE_FINISHED] #####<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ==== View image ====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> ModeThumbnails_ThumNavGst 2<br /> NextMode: 3, ThIdle: 1<br /> 2 NextMode: 3, ThIdle: 1<br /> <br /> ##### Msg handled by General and Queue: [0100][00000100]-[USER] #####<br /> ModeThumbnails_ThumNavGst 2<br /> AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 1<br /> BrowseOnActive<br /> BrowseEndMode<br /> BrowseIndexEnd<br /> AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> ModePlayback_PlyBckConst Create Element<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; ModePlayback.c: Setting Playback mode<br /> <br /> **GetStorageMediaStatus type = 0 **<br /> I43_GetStorageMediaStatus - 0<br /> ModePlayback_RstCurImg Create Element<br /> MsgH_SetCurEleDGst 3<br /> I43_GetDCFInfo<br /> I43_GetFileAttributes - OK<br /> AppSetMode 0x90 -1<br /> BrowseOnActive<br /> <br /> ##### Msg handled by General: [0100][00000000]-[USER] #####<br /> BrowseOnModeStart<br /> BrowseEndMode<br /> BrowseImageStart<br /> THR - Image<br /> <br /> ##### Msg handled by General and Queue: [0800][00000090]-[NEW_MODE] #####<br /> <br /> ##### Msg handled by Quene: [1a00][00000001]-[VALID_IMAGE] #####<br /> Read ADC1 Button 31<br /> ModePlayback_RstCurImgEnd<br /> BrowseOnModeEnd<br /> MsgH_SetCurEleDGst 0<br /> Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]<br /> <br /> ## jpeg file ##<br /> HceOsdDrawBattery level 4<br /> <br /> ##### Msg handled by General and Queue: [0800][000000c0]-[NEW_MODE] #####<br /> Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]<br /> <br /> ## jpeg file ##<br /> HceOsdDrawBattery level 4<br /> <br /> ##### Msg handled by General: [0100][00000000]-[USER] #####<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> ==== Change mode to &quot;Settings&quot; ====<br /> &lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> HCE_ReadFGPIOButtons 0x04<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> HCE_ReadFGPIOButtons 0x05<br /> ##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> NextMode: 7, ThIdle: 1<br /> 2 NextMode: 7, ThIdle: 1<br /> HceSetSwitchWorkMode WorkModeId: 7AsdMode_ChgModeDesed Create Element<br /> AppSetMode 0x30 1<br /> BrowseOnActive<br /> BrowseEndMode<br /> BrowseMenuEnd<br /> <br /> ##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####<br /> HCE_SetupMenuConstructor Create Element<br /> AppSetMode 0x0 -1<br /> BrowseOnActive<br /> Go to Menu mode!!!BrowseOnModeStart<br /> BrowseEndMode<br /> BrowseOnModeEnd<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt; MNU_SetupListConstr<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> Draw Jpeg [A:\JPEG\BRI_Y.JPG]<br /> Draw Jpeg [A:\JPEG\AON_W.JPG]<br /> Draw Jpeg [A:\JPEG\S3M_W.JPG]<br /> Draw Jpeg [A:\JPEG\DTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\NTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\F60_W.JPG]<br /> Draw Jpeg [A:\JPEG\LEN_W.JPG]<br /> Draw Jpeg [A:\JPEG\VER_W.JPG]<br /> Draw Jpeg [A:\JPEG\DEF_W.JPG]<br /> <br /> ##### Msg handled by General and Queue: [0800][00000000]-[NEW_MODE] #####<br /> &lt;/syntaxhighlight&gt;Set volume to &quot;Low&quot;&lt;syntaxhighlight lang=&quot;c&quot;&gt;<br /> Read ADC1 Button 2<br /> Right Pressed<br /> Draw Jpeg [A:\JPEG\BRI_W.JPG]<br /> <br /> ## passed jpeg no. = 16 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> Move MENU_CURITEM 1<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> _ASDM_ST_CUR_MODEID 7<br /> *************HCE_DrawSubMenuTitle uStartX 212, uStartY 18<br /> <br /> ## jpeg index = 16 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> uStartX,376 uStartY,190 uStartW,300 w,57<br /> wreal 82<br /> uStartX,376 uStartY,280 uStartW,300 w,53<br /> wreal 77<br /> uStartX,376 uStartY,370 uStartW,300 w,44<br /> wreal 64<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 5<br /> Down Pressed<br /> <br /> ## jpeg index = 17 ##<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> uStartX,376 uStartY,190 uStartW,300 w,57<br /> wreal 82<br /> uStartX,376 uStartY,280 uStartW,300 w,53<br /> wreal 77<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 3<br /> Enter Pressed<br /> HCE_SaveOptions<br /> USP saved successfully.<br /> END<br /> <br /> &gt;&gt;&gt;&gt;&gt;&gt; MNU_SetupListConstr<br /> Draw Jpeg [A:\JPEG\BG_SU.JPG]<br /> _ASDM_ST_CUR_MODEID 7<br /> HceOsdDrawBattery level 4<br /> Draw Jpeg [A:\JPEG\BRI_W.JPG]<br /> Draw Jpeg [A:\JPEG\AON_Y.JPG]<br /> Draw Jpeg [A:\JPEG\S3M_W.JPG]<br /> Draw Jpeg [A:\JPEG\DTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\NTS_W.JPG]<br /> Draw Jpeg [A:\JPEG\F60_W.JPG]<br /> Draw Jpeg [A:\JPEG\LEN_W.JPG]<br /> Draw Jpeg [A:\JPEG\VER_W.JPG]<br /> Draw Jpeg [A:\JPEG\DEF_W.JPG]<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> Read ADC1 Button 31<br /> <br /> ##### Msg handled by General: [0100][00000100]-[USER] #####<br /> <br /> &lt;/syntaxhighlight&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Construction.jpg&diff=1918 File:Disney Flix Camcorder Construction.jpg 2023-10-02T02:56:15Z <p>Chicken: </p> <hr /> <div>Overview of how all circuit boards of Disney Flix camcorder are connected together</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Display_PCB_back.jpg&diff=1917 File:Disney Flix Camcorder Display PCB back.jpg 2023-10-02T02:53:55Z <p>Chicken: </p> <hr /> <div>Back-side of display circuit board of Disney Flix camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Controls_PCB_Back.jpg&diff=1916 File:Disney Flix Camcorder Controls PCB Back.jpg 2023-10-02T02:52:53Z <p>Chicken: </p> <hr /> <div>Back-side of controls circuit board of Disney Flix camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Controls_PCB_front.jpg&diff=1915 File:Disney Flix Camcorder Controls PCB front.jpg 2023-10-02T02:51:56Z <p>Chicken: </p> <hr /> <div>Front-side of controls circuit board of Disney Flix camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Sensor_PCB_back.jpg&diff=1914 File:Disney Flix Sensor PCB back.jpg 2023-10-02T02:50:48Z <p>Chicken: </p> <hr /> <div>Back-side of sensor circuit board of Disney Flix camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Sensor_PCB_Front.jpg&diff=1913 File:Disney Flix Camcorder Sensor PCB Front.jpg 2023-10-02T02:49:29Z <p>Chicken: </p> <hr /> <div>Front-side of sensor circuit board of Disney Flix camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Main_PCB_back.jpg&diff=1912 File:Disney Flix Camcorder Main PCB back.jpg 2023-10-02T02:47:30Z <p>Chicken: </p> <hr /> <div>Back-side of main circuit board of Disney Flix Camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder_Main_PCB_Front.jpg&diff=1911 File:Disney Flix Camcorder Main PCB Front.jpg 2023-10-02T02:46:00Z <p>Chicken: </p> <hr /> <div>Front-side of main circuit board of Disney Flix Camcorder</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Disney_Flix_Camcorder.jpg&diff=1910 File:Disney Flix Camcorder.jpg 2023-10-02T02:43:00Z <p>Chicken: </p> <hr /> <div>Disney Flix Camcorder, ca 2007</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1909 Canon PowerShot G9 2023-10-02T00:07:44Z <p>Chicken: add image of unpoplated header</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> [[File:Canon PowerShot G9 debug header.jpg|thumb|CN1003, a candidate for JTAG and/or serial debug]]<br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_debug_header.jpg&diff=1908 File:Canon PowerShot G9 debug header.jpg 2023-10-02T00:06:19Z <p>Chicken: </p> <hr /> <div>CN1003, candidate of debug and/or JTAG header for Canon PowerShot G9</div> Chicken https://wiki.recessim.com/w/index.php?title=User:Chicken&diff=1901 User:Chicken 2023-10-01T03:26:54Z <p>Chicken: add link to Teardown of Canon G9</p> <hr /> <div>I reverse engineer out of curiosity and stubbornness. Addicted to consumer cameras and all things [[wikipedia:Automatic_identification_system|AIS]]. <br /> <br /> === My Teardowns on Recessim ===<br /> [[Canon PowerShot G9]]<br /> <br /> ===My Reverse Engineering Projects===<br /> Reverse engineering of the internals of the Silabs [https://www.silabs.com/wireless/proprietary/ezradiopro-sub-ghz-ics EZRadioPRO] family of ISM radios, including an 8051, firmware patches, and docs hidden inside the vendor software.<br /> <br /> https://github.com/astuder/Inside-EZRadioPRO<br /> <br /> Teardowns &amp; analysis of a few AIS receivers:<br /> <br /> SRT Marine Krypton: https://mstdn.social/@adistuder/110210851234578384<br /> <br /> Matsutec AR-10: https://mstdn.social/@adistuder/110029304514959479<br /> <br /> Fixing (reviving) the deprecated maps module in Adobe Lightroom Classic. Involved reverse engineering and patching LUA executables.<br /> <br /> https://github.com/astuder/lightroom-map-fix<br /> <br /> PPLD, a decompiler for PCBoard PPEs that I wrote many moons ago. PPEs were plugins for the once popular BBS software [[wikipedia:PCBoard|PCBoard]].<br /> <br /> https://github.com/astuder/ppld<br /> <br /> ===Socials===<br /> GitHub: [https://github.com/astuder astuder]<br /> <br /> Twitter: [https://twitter.com/AdiStuder @adistuder]<br /> <br /> Mastodon: [https://mstdn.social/@adistuder @adistuder@mstdn.social]<br /> <br /> Discord: #adistuder</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1900 Canon PowerShot G9 2023-10-01T03:25:37Z <p>Chicken: </p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> ===Main PCB===<br /> <br /> ====CPU/DSP====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> *Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> *Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> *Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> *Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> *Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> *Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> *Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> <br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> *Located near to SD card holder<br /> *Multiple pads connected to test points<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ====CCD Interface====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> *5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> *5-pin package<br /> <br /> IC2009 not populated<br /> <br /> *5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ====Lens Motor Driver====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ====Image Stabilization====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> *CK4-1105: Canon part number?<br /> *Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> *1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ====LCD Driver====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ====Audio/Video====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> *Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ====Mystery====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> *marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> *Transparent package<br /> <br /> *The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> ===Power PCB===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> *Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> ===Top Camera Control FPC===<br /> <br /> ====Button controls====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> *Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> *Also 4x on rotary dial FPC<br /> *Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> *1x rotary dial FPC<br /> *Marking A, 2-pin package (silver)<br /> <br /> ====Power? Flash?====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> *Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1899 Canon PowerShot G9 2023-10-01T03:22:31Z <p>Chicken: added parts identification</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> ==Parts Identification==<br /> [[File:Canon PowerShot G9 Main PCB Assembly Diagram.png|thumb|Assembly diagram of main PCB with component designators]]<br /> The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.<br /> <br /> === Main PCB ===<br /> <br /> ==== CPU/DSP ====<br /> IC1001 Canon '''Digic III''', and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)<br /> <br /> IC1002, IC1003 JRC '''NJM2877''' LDO<br /> <br /> * Marking 7 14 71, 5-pin package<br /> <br /> IC1004 marking FA, 5-pin package, LDO?<br /> <br /> IC1005 Seiko S-817 series LDO?<br /> <br /> * Marking G8X, 4-pin package<br /> <br /> IC1006 Seiko S-817 series LDO?<br /> <br /> * Marking B9O, 4-pin package<br /> <br /> IC1007 Seiko Epson '''RX-4571LC''' real time clock<br /> <br /> * Marking E4571<br /> <br /> SR1001 Landscape/portrait orientation sensor?<br /> <br /> Q1003, Q1010, Q1011 Toshiba '''RN4982FE''' NPN PNP Transistors with 10K Bias Resistors<br /> <br /> * Marking 6B, 6-pin package<br /> <br /> Q1005, Q1007, Q1008 Toshiba '''RN1902FE''' Dual NPN Transistors with 10K Bias Resistors<br /> <br /> * Marking XB, 6-pin package<br /> <br /> Q1012 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> * Marking 6D, 6-pin package<br /> <br /> D1001 Panasonic '''MA2S111''' Switching Diode<br /> <br /> * Marking A, 2-pin package (silver)<br /> <br /> D1002 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> * Marking MU, 3-pin package<br /> <br /> CN1001 flat flex to DC/DC PCB<br /> <br /> CN1002 flat flex to jog dial unit, TOP_M FPC<br /> <br /> CN1003 unpopulated/undocumented -&gt; JTAG/Serial?<br /> <br /> * Located near to SD card holder<br /> * Multiple pads connected to test points<br /> <br /> CN1004 USB/digital<br /> <br /> CN1005 SD card holder<br /> <br /> SW1001 switch, battery cover open detect<br /> <br /> ==== CCD Interface ====<br /> IC2002, IC2003 JRC '''NJM2877''' LDO<br /> <br /> * 5-bin package<br /> <br /> IC2004 marking 11 77 41, 6-pin package<br /> <br /> IC2005 Sony '''D4807GA''' analog frontend<br /> <br /> IC2006 marking AED3, 5-pin package<br /> <br /> IC2008 JRC '''NJM2877''' LDO<br /> <br /> * 5-pin package<br /> <br /> IC2009 not populated<br /> <br /> * 5-pin package<br /> <br /> CN2001 connector for image sensor assembly <br /> <br /> ==== Lens Motor Driver ====<br /> IC3001 Toshiba '''TB6609FL''' motor driver?<br /> <br /> IC3002 Toshiba '''TB6552FNG''' Dual-Bridge Driver for DC Motors<br /> <br /> CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)<br /> <br /> ==== Image Stabilization ====<br /> IC3201 Renesas(?) '''R2J30504''' 725104<br /> <br /> * CK4-1105: Canon part number?<br /> * Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS<br /> <br /> SR3201, SR3202 Murata '''ENC-03''' series, angular rate sensors<br /> <br /> * 1x ENC-03RC-R and 1x ENC-03RD-R<br /> <br /> ==== LCD Driver ====<br /> IC4001 '''15019GB''' 7CR0G 070 LCD power? Driver?<br /> <br /> CN4001 LCD panel<br /> <br /> CN4002 LCD backlight<br /> <br /> ==== Audio/Video ====<br /> IC4501 Wolfson '''WM1400G''' Audio driver/Codec<br /> <br /> IC4502 JRC '''NJM2571''' Low Voltage Video Amplifier with LPF<br /> <br /> * Marking A51, 6-pin package<br /> <br /> IC4503 unpopulated<br /> <br /> CN4501 Microphone<br /> <br /> CN4502 A/V out<br /> <br /> ==== Mystery ====<br /> [[File:Canon PowerShot G9 IC502.jpg|thumb|Low resolution die image of mystery IC502]]<br /> The function of this section, and its main chip IC502 is unclear. <br /> <br /> IC501 JRC '''NJM2877''' LDO<br /> <br /> * marking 7 12 62, 5-pin package<br /> <br /> IC502 the Mystery IC<br /> <br /> * Transparent package<br /> <br /> * The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.<br /> <br /> Q501 SOT23-6 marking FM<br /> <br /> ZD501 marking R, reverse biased<br /> <br /> === DC/DC PCB ===<br /> IC601 FE '''7761R''' multi-output DC-DC power management controller<br /> <br /> IC691 Seiko S-817 series LDO?<br /> <br /> * Marking CUW, 4-pin package<br /> <br /> BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery<br /> <br /> CN601 battery connector<br /> <br /> CN651 flat flex to main PCB<br /> <br /> === Top_M FPC ===<br /> <br /> ==== Button controls ====<br /> CN251 to TOP_I FPC<br /> <br /> D251, D252, 254, D255 Panasonic '''MA4Z159''' Dual Switching Diodes<br /> <br /> * Marking M1B, 4-pin package<br /> <br /> D253 Panasonic '''MA3S132E''' Dual Switching diodes<br /> <br /> * Also 4x on rotary dial FPC<br /> * Marking MU, 3-pin package (silver)<br /> <br /> D? Panasonic '''MA2S111''' Switching Diode<br /> <br /> * 1x rotary dial FPC<br /> * Marking A, 2-pin package (silver)<br /> <br /> ==== Power ====<br /> Q581 Toshiba '''RN4984FE''' NPN PNP Transistors with 47K Bias Resistors<br /> <br /> * Marking 6D, 6-pin package<br /> <br /> Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET<br /> <br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_IC502.jpg&diff=1898 File:Canon PowerShot G9 IC502.jpg 2023-10-01T03:17:54Z <p>Chicken: </p> <hr /> <div>Low resolution die image of an IC with unknown function found in Canon PowerShot G9</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_Main_PCB_Assembly_Diagram.png&diff=1897 File:Canon PowerShot G9 Main PCB Assembly Diagram.png 2023-10-01T02:56:16Z <p>Chicken: </p> <hr /> <div>Assembly diagram of main circuit board of the Canon Powershot G9. Source: Canon G9 Service Manual</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1896 Canon PowerShot G9 2023-10-01T01:46:45Z <p>Chicken: remove extra line break</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom<br /> <br /> Released in Oct 2007, PCB date code 29th week of 2007<br /> [[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> == Parts Identification ==<br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1895 Canon PowerShot G9 2023-10-01T01:46:20Z <p>Chicken: </p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom<br /> <br /> Released in Oct 2007, PCB date code 29th week of 2007<br /> [[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> &lt;br /&gt;<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> <br /> == Parts Identification ==<br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1894 Canon PowerShot G9 2023-10-01T01:44:43Z <p>Chicken: add scan of image sensor</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom<br /> <br /> Released in Oct 2007, PCB date code 29th week of 2007<br /> [[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]<br /> <br /> ==Teardown Pictures==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|thumb|Main PCB, top view|alt=|none]]<br /> &lt;br /&gt;<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|thumb|Main PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|thumb|Power PCB, top view|alt=|none]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|thumb|Power PCB, bottom view|alt=|none]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)|alt=|none]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|thumb|Back camera control PCB (jog-wheel, various buttons)|alt=|none]]<br /> [[File:Canon PowerShot G9 image sensor.jpg|none|thumb|12.1 MP CMOS image sensor]]<br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_image_sensor.jpg&diff=1893 File:Canon PowerShot G9 image sensor.jpg 2023-10-01T01:40:08Z <p>Chicken: </p> <hr /> <div>Flat-flex assembly from Canon PowerShot G9 with 12.1 MP CMOS image sensor</div> Chicken https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&diff=1892 Canon PowerShot G9 2023-10-01T00:24:29Z <p>Chicken: started page, added pictures</p> <hr /> <div>Teardown of the Canon PowerShot G9 point-and-shoot camera.<br /> <br /> 12.1 MP CMOS with 6x IS optical zoom<br /> <br /> Released in Oct 2007, PCB date code 29th week of 2007<br /> [[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9]]<br /> <br /> == Teardown Pictures ==<br /> [[File:Canon PowerShot G9 Main PCB Top.jpg|left|thumb|Main PCB, top view]]<br /> &lt;br /&gt;<br /> [[File:Canon PowerShot G9 Main PCB Back.jpg|left|thumb|Main PCB, bottom view]]<br /> [[File:Canon PowerShot G9 Power PCB Top.jpg|left|thumb|Power PCB, top view]]<br /> [[File:Canon PowerShot G9 Power PCB bottom.jpg|left|thumb|Power PCB, bottom view]]<br /> [[File:Canon PowerShot G9 Top Controls FPC.jpg|left|thumb|Top camera control PCB (mode selection, shutter button, power button, flash control)]]<br /> [[File:Canon PowerShot G9 Back Camera Control PCB.jpg|left|thumb|Back camera control PCB (jog-wheel, various buttons)]]<br /> &lt;br /&gt;</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_Back_Camera_Control_PCB.jpg&diff=1891 File:Canon PowerShot G9 Back Camera Control PCB.jpg 2023-10-01T00:09:03Z <p>Chicken: </p> <hr /> <div>PCB for back-side controls of the Canon PowerShot G9</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_Top_Controls_FPC.jpg&diff=1890 File:Canon PowerShot G9 Top Controls FPC.jpg 2023-10-01T00:05:08Z <p>Chicken: </p> <hr /> <div>Flexible circuit board for top-side camera controls of Canon PowerShot G9</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon_PowerShot_G9_Power_PCB_bottom.jpg&diff=1889 File:Canon PowerShot G9 Power PCB bottom.jpg 2023-09-30T23:57:44Z <p>Chicken: </p> <hr /> <div>Bottom-view of power supply PCB of Canon PowerShot G9</div> Chicken https://wiki.recessim.com/w/index.php?title=File:Canon-powershot-g9.jpg&diff=1888 File:Canon-powershot-g9.jpg 2023-09-30T23:53:17Z <p>Chicken: </p> <hr /> <div>Outside view of Canon PowerShot G9</div> Chicken