Reverse Engineering Serial Ports devtty. S0. Given the name of this blog and the number of requests that Ive had, I think its high time we discussed serial ports specifically, serial ports in embedded systems. My goal here is to describe the techniques that Ive found effective in identifying and reverse engineering embedded serial ports through the use of definitive testing and educated guesses, and without the need for expensive equipment. If you follow the pictures above you will be able to replicate this layout. The Resistors are in place to stop power surge from damaging the Light Emiting Diodes, The. This is a library for sending and receiving DMX codes using the Arduino plattform or a ATmega ATmega168, ATmega328 or similar processor with a clock speed of. Single chip USB to asynchronous serial data transfer interface. Entire USB protocol handled on the chip. No USB specific firmware programming required. Replies to Android USB Host Arduino How to communicate without rooting your Android Tablet or Phone. Introduction. Serial ports are extremely useful to embedded developers, who commonly use them for Accessing the boot loader. Observing boot and debug messages. Interacting with the system via a shell. Needless to say, this functionality is also useful to hackers, so finding a serial port on an embedded device can be very advantageous. Secure Digital SD is a nonvolatile memory card format developed by the SD Card Association SDA for use in portable devices. The standard was introduced in August. So one day I was trying to interface to a Freescale MMA8451Q accelerometer, for a project I was working on, and I was having a difficult time getting data back from. Serial Communication RS232 Basics. In the previous post, we discussed about the basics of serial communication. In this post, we will learn about the RS232. The world isnt run by weapons anymore, or energy, or money. Its run by little ones and zeroes, little bits of data. Its all just electrons. As a case study, well be examining the PCB of a Westell 9. EM Fi. OS router for possible serial ports Westell 9. Arduino Serial Data Bits Stop Bits Transfer' title='Arduino Serial Data Bits Stop Bits Transfer' />EM PCBNow, these arent your dads RS 2. Universal Asynchronous Receiver Transmitters UARTs, commonly found in embedded devices. Although protocol compatible, RS 2. UART are not voltage compatible from here on out I will use the terms UART and serial port interchangeably. UARTs most commonly operate at 3. Unfortunately there arent any industry standardized UART pin outs, and manufacturers dont often go around advertising or documenting their debug interfaces, so well need to do a bit of work in order to interface with these serial ports. Specifically, we need to reverse engineer both the hardware interface and the software protocol settings. Lets start with the hardware interface first. For this, youll need a multimeter and a pair of eyeballs or even one will do just fine. Yes, oscilloscopes and logic analyzers are useful and sometimes necessary, but 9. Identifying Serial Headers. The first step is to try to identify potential candidates for serial port headers. Most serial port headers have at a minimum four pins Typically youll want to look for a single row of 4 6 pins, although this is not a hard and fast rule and they can come in any pin configuration the manufacturer has decided on. On our 9. 10. 0EM PCB we find two possible candidates, labeled P1. P1. 40. 4 Possible serial port headers. Sometimes you wont have a nicely broken out set of pins like this, and youll have to examine test points on the board usually starting with test points closest to the So. C is a good idea. Here is an example of a serial port exposed via test points on a different board, the WL5. G Serial port test points on a WL5. GIn either case the process of pin identification is the same, but usually takes longer if there is no header since there will likely be more than 4 test points on the board that you will need to examine. At this point either P1. P1. 40. 4 could be serial port headers. Or they could both be serial port headers. Or neither could be a serial port header. So well examine the pins on each header individually to try to gain some insight. Visual Inspection. First, lets visibly inspect the pins. Well start by taking a look at P1. P1. 40. 2 top. P1. On the top layer of the PCB the right most pin is labeled as pin 1. This is not terribly important, but it gives a common frame of reference when describing the pin numbers. On the bottom of the PCB we see that pin 3 has four traces in a crosshair pattern that connect it to the surrounding ground plane. This easily identifies pin 3 as ground. Pins 2 and 4 have thin traces connected to them, while pin 1 is connected to a fatter trace. Wide traces are typically used for supplying power, while narrow traces are usually used for signal traces. This suggests that pin 1 is Vcc and pins 2 and 4 are potentially transmit and receive although we dont yet know which is which. Lets take a look at the P1. P1. 40. 4 top. P1. Here, the left most pin is marked as pin 1. Again, we see that pin 3 is connected to ground on the bottom layer of the PCB. Pin 4 also has a thin trace connected to it, so it could be a transmit or receive pin. The other two pins of P1. PCB. It could be that they arent connected to anything, but more likely their traces are connected on one of the inner layers of the PCB that we cant see. Time to break out the multimeter. Identifying Grounded Pins. A continuity test introduces a small current into the circuit if enough current passes from one probe to the other i. The first thing we want to do is perform a continuity test between ground and all the pins on each of the headers using the multimeter. This will tell us which pins are connected directly to ground. Well start with P1. Metal shielding is a convenient ground point to use for testing. Placing one probe on a shield and touching the other to pin 3, the multimeter emits a continuous audible tone, indicating that pin 3 is connected to ground as we previously observed Continuity test between pin 3 and ground. Performing the same test against pins 2 and 4 results in no audible tone, so we know those pins arent grounded. The same continuity tests for P1. How To Install Httpd On Centos Download more. Thus we know that for both P1. P1. 40. 4 pin 3 is grounded and pins 2 and 4 are not. Identifying Vcc. Vcc is less important to identify since we dont actually need to connect anything to it, but locating the Vcc pin is a good exercise and is useful in eliminating the Vcc pin as a possible candidate for transmit or receive. Based on the trace widths, we suspect that pin 1 is Vcc measuring the voltage on pin 1 when the board is powered on appears to confirm this Measuring voltage on P1. A steady voltage reading on P1. The same voltage readings hold true for P1. P1. 40. 2 and P1. Vcc. Another method of identifying Vcc is to perform a continuity test between ground and the suspected Vcc pin. Although it may first appear counter intuitive, this will commonly result in a very short beep though not a continuous tone. What happens with the Vcc continuity test is that there is usually a filter capacitor connected between the Vcc pin and ground. This is done to eliminate any possible noise in the power lines on the PCB, and such filter capacitors are used liberally in any well designed board. Due to the nature of how capacitors work, they will pass a direct current very briefly until they are charged to capacity, at which point they will cease passing direct current and will block direct current, resulting in the short beep observed during the continuity test it is worth nothing that current doesnt actually pass through a capacitor, although it appears that way to an outside observer. Although it doesnt always work, the continuity test is a more conclusive method of determining Vcc than simply measuring the voltage on each pin, as any number of pins could all read the same voltage. Note that you will also need a multimeter with a rather responsive continuity tester in order to perform this test properly cheaper ones can take up to a second or more before they are triggered, at which point the capacitor has already been charged. Most multimeters in the 1. Identifying the Transmit Pin. The transmit pin is fairly easy to identify provided that the serial port is active and is transmitting data and if its not, this entire effort will likely be futile anyway. The transmit pin on the board will be pulled high to the same voltage as Vcc typically 3. As it transmits bits of data, the voltage will drop to 0 volts to send a space, then back to 3.