Reverse Engineering Serial Ports devtty. S0. Given the name of this blog and the number of requests that Ive had, I think its high time we discussed serial ports specifically, serial ports in embedded systems. My goal here is to describe the techniques that Ive found effective in identifying and reverse engineering embedded serial ports through the use of definitive testing and educated guesses, and without the need for expensive equipment. Introduction. Serial ports are extremely useful to embedded developers, who commonly use them for Accessing the boot loader. Observing boot and debug messages. Interacting with the system via a shell. Needless to say, this functionality is also useful to hackers, so finding a serial port on an embedded device can be very advantageous. As a case study, well be examining the PCB of a Westell 9. EM Fi. OS router for possible serial ports Westell 9. EM PCBNow, these arent your dads RS 2. Universal Asynchronous Receiver Transmitters UARTs, commonly found in embedded devices. Although protocol compatible, RS 2. UART are not voltage compatible from here on out I will use the terms UART and serial port interchangeably. UARTs most commonly operate at 3. Unfortunately there arent any industry standardized UART pin outs, and manufacturers dont often go around advertising or documenting their debug interfaces, so well need to do a bit of work in order to interface with these serial ports. OnionIoT/Onion-Docs/master/Omega2/Documentation/Get-Started/img/connecting-serial-kernel-messages.png' alt='Find Cpu Serial Number Linux Kernel Download' title='Find Cpu Serial Number Linux Kernel Download' />Specifically, we need to reverse engineer both the hardware interface and the software protocol settings. Lets start with the hardware interface first. For this, youll need a multimeter and a pair of eyeballs or even one will do just fine. Yes, oscilloscopes and logic analyzers are useful and sometimes necessary, but 9. Identifying Serial Headers. The first step is to try to identify potential candidates for serial port headers. Most serial port headers have at a minimum four pins Typically youll want to look for a single row of 4 6 pins, although this is not a hard and fast rule and they can come in any pin configuration the manufacturer has decided on. Find Cpu Serial Number Linux Kernel Panic' title='Find Cpu Serial Number Linux Kernel Panic' />Given the name of this blog and the number of requests that Ive had, I think its high time we discussed serial ports specifically, serial ports in embedded. How To Crack Adobe Digital Editions Drm Removal. Ham Radio Software on Centos Linux Configuring multitudes of Amateur HAM Radio software for Centos6 Centos5 Linux. Multiport Serial BoardsCardsAdapters 5. Intro to Multiport Serial. Multiport serial cards install in slots in a PC on the ISA or PCI bus. They are also called. Introduction. When choosing a build system for an embedded Linux project, many options are available such as YoctoOpenEmbedded, PTXdist, Buildroot, LTIB, OpenBricks. We will look at boot process of linux kernel on AT91RM9200 systemonchip, built around the ARM920T ARM Thumb processor. Kwickbyte builds an embedded board called. On our 9. 10. 0EM PCB we find two possible candidates, labeled P1. P1. 40. 4 Possible serial port headers. Sometimes you wont have a nicely broken out set of pins like this, and youll have to examine test points on the board usually starting with test points closest to the So. C is a good idea. Here is an example of a serial port exposed via test points on a different board, the WL5. Find Cpu Serial Number Linux Kernel UpdateG Serial port test points on a WL5. GIn either case the process of pin identification is the same, but usually takes longer if there is no header since there will likely be more than 4 test points on the board that you will need to examine. At this point either P1. P1. 40. 4 could be serial port headers. Or they could both be serial port headers. Or neither could be a serial port header. So well examine the pins on each header individually to try to gain some insight. Visual Inspection. First, lets visibly inspect the pins. Well start by taking a look at P1. The kernels commandline parameters The following is a consolidated list of the kernel parameters as implemented by the setup, coreparam and moduleparam. P1. 40. 2 top. P1. On the top layer of the PCB the right most pin is labeled as pin 1. This is not terribly important, but it gives a common frame of reference when describing the pin numbers. EZUSB on Linux. A company called AnchorChips now owned by Cypress came out with an innovative and useful product a while ago an enhanced 8051 8 bit CPU based. Summary of the changes and new features merged in the Linux kernel during the 4. Linux Device Drivers, 2nd Edition By Alessandro Rubini Jonathan Corbet 2nd Edition June 2001 0596000081, Order Number 0081 586 pages, 39. On the bottom of the PCB we see that pin 3 has four traces in a crosshair pattern that connect it to the surrounding ground plane. This easily identifies pin 3 as ground. Pins 2 and 4 have thin traces connected to them, while pin 1 is connected to a fatter trace. Find Cpu Serial Number Linux Kernel ProgrammingWide traces are typically used for supplying power, while narrow traces are usually used for signal traces. This suggests that pin 1 is Vcc and pins 2 and 4 are potentially transmit and receive although we dont yet know which is which. Lets take a look at the P1. P1. 40. 4 top. P1. Here, the left most pin is marked as pin 1. Again, we see that pin 3 is connected to ground on the bottom layer of the PCB. Pin 4 also has a thin trace connected to it, so it could be a transmit or receive pin. The other two pins of P1. PCB. It could be that they arent connected to anything, but more likely their traces are connected on one of the inner layers of the PCB that we cant see. Time to break out the multimeter. Identifying Grounded Pins. A continuity test introduces a small current into the circuit if enough current passes from one probe to the other i. The first thing we want to do is perform a continuity test between ground and all the pins on each of the headers using the multimeter. This will tell us which pins are connected directly to ground. Well start with P1. Metal shielding is a convenient ground point to use for testing. Placing one probe on a shield and touching the other to pin 3, the multimeter emits a continuous audible tone, indicating that pin 3 is connected to ground as we previously observed Continuity test between pin 3 and ground. Performing the same test against pins 2 and 4 results in no audible tone, so we know those pins arent grounded. The same continuity tests for P1. Thus we know that for both P1. P1. 40. 4 pin 3 is grounded and pins 2 and 4 are not. Identifying Vcc. Vcc is less important to identify since we dont actually need to connect anything to it, but locating the Vcc pin is a good exercise and is useful in eliminating the Vcc pin as a possible candidate for transmit or receive. Based on the trace widths, we suspect that pin 1 is Vcc measuring the voltage on pin 1 when the board is powered on appears to confirm this Measuring voltage on P1. A steady voltage reading on P1. The same voltage readings hold true for P1. P1. 40. 2 and P1. Vcc. Another method of identifying Vcc is to perform a continuity test between ground and the suspected Vcc pin. Although it may first appear counter intuitive, this will commonly result in a very short beep though not a continuous tone. What happens with the Vcc continuity test is that there is usually a filter capacitor connected between the Vcc pin and ground. This is done to eliminate any possible noise in the power lines on the PCB, and such filter capacitors are used liberally in any well designed board. Due to the nature of how capacitors work, they will pass a direct current very briefly until they are charged to capacity, at which point they will cease passing direct current and will block direct current, resulting in the short beep observed during the continuity test it is worth nothing that current doesnt actually pass through a capacitor, although it appears that way to an outside observer. Although it doesnt always work, the continuity test is a more conclusive method of determining Vcc than simply measuring the voltage on each pin, as any number of pins could all read the same voltage. Note that you will also need a multimeter with a rather responsive continuity tester in order to perform this test properly cheaper ones can take up to a second or more before they are triggered, at which point the capacitor has already been charged. Most multimeters in the 1. Identifying the Transmit Pin. The transmit pin is fairly easy to identify provided that the serial port is active and is transmitting data and if its not, this entire effort will likely be futile anyway. The transmit pin on the board will be pulled high to the same voltage as Vcc typically 3. As it transmits bits of data, the voltage will drop to 0 volts to send a space, then back to 3.