Kenwood TH-D74A: Difference between revisions
No edit summary |
No edit summary |
||
| Line 42: | Line 42: | ||
</gallery><br /> | </gallery><br /> | ||
== Reverse Engineering Efforts == | ==Reverse Engineering Efforts== | ||
[[File:Kenwood TH-D74 and JTAGulator.jpg|none|thumb|Kenwood TH-D74 connected to JTAGulator]] | [[File:Kenwood TH-D74 and JTAGulator.jpg|none|thumb|Kenwood TH-D74 connected to JTAGulator]] | ||
=== High level goals === | ===High level goals=== | ||
* Obtain a copy of the firmware for analysis/modification | *Obtain a copy of the firmware for analysis/modification | ||
* Understand how the radio works and what test ports are available internally | *Understand how the radio works and what test ports are available internally | ||
==== Obtaining firmware ==== | ====Obtaining firmware==== | ||
* Determine routes of attack | *Determine routes of attack | ||
** JTAG Port | **JTAG Port | ||
** Serial Port | **Serial Port | ||
** Hardware attack - Remove Flash Memory and read directly (possibly encrypted) | **Hardware attack - Remove Flash Memory and read directly (possibly encrypted) | ||
Initially the radio was opened and wires were soldered to test points and a port of interest as seen in the video below. | Initially the radio was opened and wires were soldered to test points and a port of interest as seen in the video below. | ||
<br /> | <br /><nowiki><youtube></youtube></nowiki> | ||
==== Understand how the radio works ==== | ====Understand how the radio works==== | ||
<br /> | <br /> | ||
==Datasheets== | ==Datasheets== | ||