Changes

Jump to navigation Jump to search
5,508 bytes added ,  03:04, 22 October 2020
no edit summary
[[File:TH-D74A.jpg|none|thumb|Fully Assembled Kenwood TH-D74A|alt=]]<br />Full teardown pictures and videos of the TH-D74 along with notes on reverse engineering and obtaining a copy of the firmware.
==Teardown Video==
20 6 minute video @ 3x playback speed showing full disassembly of the radiowith commentary, full length video with no audio[https://youtu.<br be/><youtube width="320" height="240">UVwoPPe6DwQ</youtube>Q_n_bs6f8gE here].
<youtube width="320" height="240">Q_n_bs6f8gE</youtube>==Teardown PCB Pictures==<gallery mode="packed" widths="300" heights="200">File:TH-D74A Processor board Top.jpg|Processor Board TopFile:TH-D74A Processor.jpg|Processor Shield RemovedFile:TH-D74A GPS Circuit.JPG|GPS circuit normally under a shield.File:TH-D74A Processor board bottom.jpg|Processor Board BottomFile:TH-D74A Transceiver board top.jpg|Transceiver Board TopFile:TH-D74A Transceiver board top zoom 1.jpg|Transceiver Board Top Zoom 1File:TH-D74A Transceiver board top zoom 2.jpg|Transceiver Board Top Zoom 2File:TH-D74A Transceiver board bottom.jpg|Transceiver Board BottomFile:TH-D74A Transceiver board bottom zoom 1.jpg|Transceiver Board Bottom Zoom 1File:TH-D74A Transceiver board bottom zoom 2.jpg|Transceiver Board Bottom Zoom 2File:TH-D74A FJ-X5 top.jpg|FM Radio Module TopFile:TH-D74A FJ-X5 bottom.jpg|FM Radio Module Bottom</gallery>==Port and Test Point Identification==<gallery mode="packed" heights="200">File:Kenwood TH-D74 Control Board Boot Pins.jpeg|Test point locations for Boot[] pins which set the boot-up mode of the OMAP L138 processor, in this case to boot from NOR Flash.File:OMAP L138 Boot Mode Selection.jpeg|OMAP L138 Boot Mode Selection, TH-D74 is set to boot into NOR Flash at the top of the list.File:TH-D74A JTAG Pinout.png|JTAG pinout</gallery><br />==Modules and Interconnects==<gallery mode="packed" heights="200">File:TH-D74A LCD front.jpg|LCD FrontFile:TH-D74A LCD back.jpg|LCD BackFile:TH-D74A FM Antenna.jpg|FM Antenna FrontFile:TH-D74A FM Antenna 2.jpg|FM Antenna RearFile:TH-D74A Interconnect.jpg|Interconnect TopFile:TH-D74A Interconnect 2.jpg|Interconnect BottomFile:TH-D74A Selector.jpg|Channel Selector</gallery><br />
==PCB ImagesMechanical Pictures==<gallery widthsmode="300packed" heights="200">File:TH-D74A Processor board Top.jpgFile:TH-D74A Processor.jpgFile:TH-D74A Processor board bottomFront case interior.jpg|Front Case InteriorFile:TH-D74A Transceiver board topMetal Frame front.jpg|Metal Frame FrontFile:TH-D74A Processor board bottomMetal frame back.jpg|Metal Frame BackFile:TH-D74A Transceiver board top zoom Metal frame side 1.jpg|Metal Frame Connector SideFile:TH-D74A Transceiver board top zoom Metal frame side 2.jpg|Metal Frame Button SideFile:TH-D74A Transceiver board bottom zoom 1Metal frame top.jpg|Metal Frame TopFile:TH-D74A Transceiver board bottom zoom 2Rubber.jpg|Rubber GasketsFile:TH-D74A FJ-X5 top.jpgFile:TH-D74A FJ-X5 bottomScrews.jpg|Screws and Knobs
</gallery>
==Reverse Engineering Efforts==
[[File:Kenwood TH-D74 and JTAGulator.jpg|none|thumb|Kenwood TH-D74 connected to JTAGulator]]
 
===High level goals===
 
*Obtain a copy of the firmware for analysis/modification
*Understand how the radio works and what test ports are available internally
 
====Obtaining firmware====
 
*Determine routes of attack
**JTAG Port
**Serial Port
**Hardware attack - Remove Flash Memory and read directly (possibly encrypted/obfuscated)
**USB data capture - Packet capture firmware update (possibly encrypted/obfuscated)
 
Initially the radio was opened and wires were soldered to some test points and an interesting PCB footprint that I suspected was JTAG as seen in the video below.
 
<youtube width="320" height="240">EZP2DVU9IvQ</youtube>
 
=====Serial Port=====
The serial port turned out to just be control data sent from the CPU board to the transceiver board, explained further below. Removing the flash memory is an option although it is a BGA package so not sure about soldering wires to it so it can be read out. Furthermore, the OMAP-L138 processor seems to have a few protection mechanisms. Encryption of the firmware is one of them so that route might be useless.
 
====Hardware Attack====
 
*Desolder flash memory chip
*Re-Ball BGA and clean in preparation for socket
*Insert into BGA socket and read contents using [https://www.embeddedcomputers.net/products/FlashcatUSB_XPORT/ FlashCATUSB XPORT] with [https://www.embeddedcomputers.net/products/ParallelAdapters/ BGA-64 (LAE064)] socket
 
Other than the obvious challenge of desoldering and reballing a BGA, this worked great to get a complete image of the firmware! The firmware on the flash is not encrypted or obfuscated in any way so it's possible to make use of it immediately.
 
Cost breakdown to get complete firmware image using this method: '''$330 USD'''
 
*$145 - Replacement Processor board for TH-D74 (eBay)
*$40 - [https://www.embeddedcomputers.net/products/FlashcatUSB_XPORT/ FlashcatUSB XPORT]
*$145 - [https://www.embeddedcomputers.net/products/ParallelAdapters/ BGA-64 (LAE064)] Socket
 
Having a copy of the firmware for modification and analysis... PRICELESS!
 
====USB Data Capture====
This method costs a lot less than the hardware attack, like $330 less! See the YouTube video below for a walk-through. The software tools used are listed below, I am sure other tools would work but this is what I used.
==Modules '''''Have a better method? Create an account and Interconnect Images==update the wiki!''''' <gallery widthsyoutube width="320" height="300240">BwFnZOvw0wk</youtube>File[https:TH//www.hhdsoftware.com/hex-D74A LCD front.jpgeditor Hex Editor Neo] - Allows bitwise operations and other cool features with a 14 day free trial!File:TH-D74A LCD back.jpgFile[https:TH-D74A FM Antenna//www.jpgFile:TH-D74A FM Antenna 2eltima.jpgFile:THcom/products/usb-D74A Interconnect.jpgFile:THport-D74A Interconnect 2.jpgFile:THmonitor/ USB Analyzer] -D74A SelectorBy Eltima Software, it captures USB traffic and lets you easily export the binary data.jpg</gallery>It also comes with a 14 day free trial!
==Mechanical Images==<gallery>File[https:TH-D74A Front case interior//github.jpgFile:TH-D74A Metal Frame front.jpgFile:TH-D74A Metal frame back.jpgFile:TH-D74A Metal frame side 1.jpgFile:TH-D74A Metal frame side 2.jpgFile:THcom/BitBangingBytes/Firmware-D74A Metal frame top.jpgFile:THParse-D74A Rubber.jpgFile:THTool Firmware Parse Tool] -D74A Screws.jpg</gallery>Python program to strip header bytes from USB data captures
====Understand how the radio works====
There is a serial port labeled SCTX and SCRX (See Processor Board Bottom picture above), both of these lines appear to be transmit only from the top CPU board down to the bottom transceiver board. As the radio is tuned from one frequency to another the SCRX line has a lot of activity, when the transmitter is keyed up the SCTX line has activity. Below is a sample of what is seen on the SCRX line. [[Travis Goodspeed]] commented to me on Twitter that these commands seemed similar to the Rig Control commands sent from PC's to radio's to control them.
{| class="wikitable mw-collapsible mw-collapsed"
!SCRX
|-
|J0000
|-
|K0000
|-
|G0283
|-
|`0
|-
|G1283
|-
|B06EE14
|-
|B0A03CE
|-
|B0C0028
|-
|B11E960
|-
|B180000
|-
|B140000
|-
|B1C2812
|-
|B200018
|-
|B280A68
|-
|G;7:3
|-
|K1900
|-
|a7:6
|-
|B1C2C12
|-
|B140000
|-
|B1C2812
|-
|B200018
|-
|B280A68
|-
|F41
|-
|J01
|-
|G;7:3
|-
|`0
|}
==Datasheets==
[[:Filehttps://wiki.recessim.com/w/images/5/5d/Kenwood_TH-D74A_Datasheet_-_IC-701_-_DRAM.pdf Kenwood TH-D74A Datasheet - IC-701 - DRAM] [https://wiki.recessim.com/w/images/c/c6/Kenwood_TH-D74A_Datasheet_-_IC-702_-_omap-l138.pdf|Kenwood TH-D74A Datasheet - IC-701 702 - omap- DRAMl138[https://wiki.recessim.com/w/images/2/25/Kenwood_TH-D74A_Datasheet_-_IC-705_-_FLASH_MEMORY.pdf Kenwood TH-D74A Datasheet - IC-705 - FLASH MEMORY]
[[https:File:Kenwood TH-D74A Datasheet - IC-702 - omap-l138//wiki.recessim.com/w/images/f/f7/OMAP_L138_BootLoader.pdf|Kenwood TH-D74A Datasheet - IC-702 - omapUsing the OMAP-l138]L138 Bootloader]
[[https:File:Kenwood TH-D74A Datasheet //wiki.recessim.com/w/images/c/cd/IC- IC707_-705 _Not_exact_match_but_same_family_- FLASH MEMORY_WM8940_v4.3.pdf|Kenwood THIC-D74A Datasheet - IC707 -705 Not exact match but same family - FLASH MEMORY]WM8940]
[[:File:IC-707 - Not exact match but same family - WM8940 v4.3.pdf|IC-707 - Not exact match but same family - WM8940]]<br /><references />

Navigation menu