Kenwood TH-D74A: Difference between revisions

(10 intermediate revisions by the same user not shown)

Line 1:

[[File:TH-D74A.jpg~~|none~~|thumb|Fully Assembled Kenwood TH-D74A]]

[[File:TH-D74A.jpg|thumb|Fully Assembled Kenwood TH-D74A|alt=]]Full teardown pictures and videos of the TH-D74 along with notes on reverse engineering and obtaining a copy of the firmware.

==Teardown Video==

6 minute video @ 3x playback speed showing full disassembly of the radio with commentary, full length video with no audio [https://youtu.be/Q_n_bs6f8gE here].

Line 68:

Line 69:

=====Serial Port=====

The serial port turned out to just be control data sent from the CPU board to the transceiver board, explained further below. Removing the flash memory is an option although it is a BGA package so not sure about soldering wires to it so it can be read out. Furthermore, the OMAP-L138~~<ref>Texas Instruments Component</ref>~~ processor seems to have a few protection mechanisms. Encryption of the firmware is one of them so that route might be useless.

The serial port turned out to just be control data sent from the CPU board to the transceiver board, explained further below. Removing the flash memory is an option although it is a BGA package so not sure about soldering wires to it so it can be read out. Furthermore, the OMAP-L138 processor seems to have a few protection mechanisms. Encryption of the firmware is one of them so that route might be useless.

====Hardware Attack====

Line 166:

Line 167:

[https://wiki.recessim.com/w/images/c/cd/IC-707_-_Not_exact_match_but_same_family_-_WM8940_v4.3.pdf IC-707 - Not exact match but same family - WM8940]

<br />

@@ Line 1: / Line 1: @@
-[[File:TH-D74A.jpg|none|thumb|Fully Assembled Kenwood TH-D74A]]
+[[File:TH-D74A.jpg|thumb|Fully Assembled Kenwood TH-D74A|alt=]]Full teardown pictures and videos of the TH-D74 along with notes on reverse engineering and obtaining a copy of the firmware.
 ==Teardown Video==
 minute video @ 3x playback speed showing full disassembly of the radio with commentary, full length video with no audio [https://youtu.be/Q_n_bs6f8gE here].
@@ Line 68: / Line 69: @@
 =====Serial Port=====
-The serial port turned out to just be control data sent from the CPU board to the transceiver board, explained further below. Removing the flash memory is an option although it is a BGA package so not sure about soldering wires to it so it can be read out. Furthermore, the OMAP-L138<ref>Texas Instruments Component</ref> processor seems to have a few protection mechanisms. Encryption of the firmware is one of them so that route might be useless.
+The serial port turned out to just be control data sent from the CPU board to the transceiver board, explained further below. Removing the flash memory is an option although it is a BGA package so not sure about soldering wires to it so it can be read out. Furthermore, the OMAP-L138 processor seems to have a few protection mechanisms. Encryption of the firmware is one of them so that route might be useless.
 ====Hardware Attack====
@@ Line 166: / Line 167: @@
 [https://wiki.recessim.com/w/images/c/cd/IC-707_-_Not_exact_match_but_same_family_-_WM8940_v4.3.pdf IC-707 - Not exact match but same family - WM8940]
-<br />
+<br /><references />