Difference between revisions of "Kenwood TH-D74A"
| Line 42: | Line 42: | ||
</gallery><br /> | </gallery><br /> | ||
| + | == Reverse Engineering Efforts == | ||
| + | [[File:Kenwood TH-D74 and JTAGulator.jpg|none|thumb|Kenwood TH-D74 connected to JTAGulator]] | ||
| + | |||
| + | === High level goals === | ||
| + | |||
| + | * Obtain a copy of the firmware for analysis/modification | ||
| + | * Understand how the radio works and what test ports are available internally | ||
| + | |||
| + | ==== Obtaining firmware ==== | ||
| + | |||
| + | * Determine routes of attack | ||
| + | ** JTAG Port | ||
| + | ** Serial Port | ||
| + | ** Hardware attack - Remove Flash Memory and read directly (possibly encrypted) | ||
| + | |||
| + | Initially the radio was opened and wires were soldered to test points and a port of interest as seen in the video below. | ||
| + | <br /> | ||
| + | |||
| + | ==== Understand how the radio works ==== | ||
| + | <br /> | ||
==Datasheets== | ==Datasheets== | ||
[[:File:Kenwood TH-D74A Datasheet - IC-701 - DRAM.pdf|Kenwood TH-D74A Datasheet - IC-701 - DRAM]] | [[:File:Kenwood TH-D74A Datasheet - IC-701 - DRAM.pdf|Kenwood TH-D74A Datasheet - IC-701 - DRAM]] | ||
Revision as of 23:11, 7 June 2020
Contents
Teardown Video
6 minute video @ 3x playback speed showing full disassembly of the radio with commentary, full length video with no audio here.
Teardown PCB Pictures
Processor Board Top
Processor Shield Removed
Processor Board Bottom
JTAG Pinout
Transceiver Board Top
Transceiver Board Top Zoom 1
Transceiver Board Top Zoom 2
Transceiver Board Bottom
Transceiver Board Bottom Zoom 1
Transceiver Board Bottom Zoom 2
FM Radio Module Top
FM Radio Module Bottom
Modules and Interconnects
LCD Front
LCD Back
FM Antenna Front
FM Antenna Rear
Interconnect Top
Interconnect Bottom
Channel Selector
Mechanical Pictures
Front Case Interior
Metal Frame Front
Metal Frame Back
Metal Frame Connector Side
Metal Frame Button Side
Metal Frame Top
Rubber Gaskets
Screws and Knobs
Reverse Engineering Efforts
High level goals
- Obtain a copy of the firmware for analysis/modification
- Understand how the radio works and what test ports are available internally
Obtaining firmware
- Determine routes of attack
- JTAG Port
- Serial Port
- Hardware attack - Remove Flash Memory and read directly (possibly encrypted)
Initially the radio was opened and wires were soldered to test points and a port of interest as seen in the video below.
Understand how the radio works
Datasheets
Kenwood TH-D74A Datasheet - IC-701 - DRAM
Kenwood TH-D74A Datasheet - IC-702 - omap-l138
