Kenwood TH-D74A

Fully Assembled Kenwood TH-D74A

Teardown Video

6 minute video @ 3x playback speed showing full disassembly of the radio with commentary, full length video with no audio here.

Teardown PCB Pictures

• 
  Processor Board Top
• 
  Processor Shield Removed
• 
  Processor Board Bottom
• 
  JTAG Pinout
• 
  Transceiver Board Top
• 
  Transceiver Board Top Zoom 1
• 
  Transceiver Board Top Zoom 2
• 
  Transceiver Board Bottom
• 
  Transceiver Board Bottom Zoom 1
• 
  Transceiver Board Bottom Zoom 2
• 
  FM Radio Module Top
• 
  FM Radio Module Bottom

Modules and Interconnects

• 
  LCD Front
• 
  LCD Back
• 
  FM Antenna Front
• 
  FM Antenna Rear
• 
  Interconnect Top
• 
  Interconnect Bottom
• 
  Channel Selector

Mechanical Pictures

• 
  Front Case Interior
• 
  Metal Frame Front
• 
  Metal Frame Back
• 
  Metal Frame Connector Side
• 
  Metal Frame Button Side
• 
  Metal Frame Top
• 
  Rubber Gaskets
• 
  Screws and Knobs

Reverse Engineering Efforts

Kenwood TH-D74 connected to JTAGulator

High level goals

• Obtain a copy of the firmware for analysis/modification
• Understand how the radio works and what test ports are available internally

Obtaining firmware

• Determine routes of attack
  • JTAG Port
  • Serial Port
  • Hardware attack - Remove Flash Memory and read directly (possibly encrypted)

Initially the radio was opened and wires were soldered to test points and a port of interest as seen in the video below.
Provided ID could not be validated.

Datasheets

Kenwood TH-D74A Datasheet - IC-701 - DRAM

Kenwood TH-D74A Datasheet - IC-702 - omap-l138

Kenwood TH-D74A Datasheet - IC-705 - FLASH MEMORY

IC-707 - Not exact match but same family - WM8940