Like the Raspberry π SoC is based on a television tuner box. The vast majority of the die is related to the TV tuner functions that are completely undocumented. What techniques exist to explore undocumented physical hardware? Are we limited to reverse engineering code to find when and how these undocumented areas are used, or are there other fuzzing type techniques to find relationships between memory, flags, and potential byte instructions?
This is an abstract thought and generalization that potentially patches a hole in my understanding. There is no broader purpose in asking.
Sometimes it’s just educated guesswork.
Back in 2009, I picked up a copy of reverse engineered source code for the original PSP Chotto Shot camera. Once I got it to actually compile (code formatting issues), I proceeded to read through what had already been reversed engineered, looking for the unknown/reserved variables.
And sure enough, when I went fiddling with a few supposedly reserved variables, I discovered that one of them triggered super slow exposure mode, basically poor man’s night vision!
I never had a chance to share those findings with the PSPHacks community at the time though, it wasn’t long after when their site got shut down ☹️
Hunting and pecking work. Also trying to do research on the actual chips on the hardware helps quite a bit.
In the case they put black blobs on their chips or rub everything off, you can go with throwing an oscilloscope and checking the readings coming in and out of the device. Ive had to do that a couple of times to make a “spec” out of chips that no longer have documentation.
Here is a great example: https://bookmanarchive.com/
https://bookmanarchive.com/reverse-engineering
They do over the teardowns: https://bookmanarchive.com/reveng/teardowns/440/DBD-440.0.jpg its pretty neat!
Sometimes you get lucky and the company doesnt give a Fuck like wallmart and the kobos and the entire thing is the cheapest open source linux distro with next to open source hardware (because they couldnt be bothered). Example: https://www.linux-magazine.com/Online/Features/Basic-Hacks-for-Kobo-E-Readers Love my kobo.
Along with the other excellent answers, both boards and chips may be designed general purpose, but often components are disabled in hardware or are unpopulated. Sometimes, a jumper needs to be applied, a trace re-routed, or a JTAG command sent to activate debug mode which allows physical access to parts of a board/chip that are gated by the JTAG controller.
So your best friends here beyond fuzzing and probing are searching for similar schematics, painstakingly testing all I/O with an oscilloscope, and taking an electron microscope to things to see what’s physically there.
Sometimes though, it’s as simple as thinking like the engineers who designed the component in the first place and asking yourself “If I were designing this, what shortcuts would I take, what would I want to debug / put in a test suite, and what would I make general purpose in order to cut costs on component placement and board reuse.
I did not know JTAG was used like this, I thought it was passive in functionality
Even for debugging jtag is quite active. It can essentially (depending on the soc or micro you’re working with) override the device and force it into specific conditions or change register values.
Very useful.
This is an extremely high level answer, but you have to be equipped to even notice whatever it was did when you twiddled it. It might not be obvious, and this is muddied by the fact that most of the reserved or undocumented bits/registers/addresses/pins will probably do nothing. Or crash the machine. So that entails having a vague idea of what the device might be capable of in the first place so you can have the right equipment or software hooked up to it to even observe results. There’s probably no automated programmatic way to do that in most cases.
It’s bad enough when all you have in front of you is a microcontroller that can only manipulate its own memory and a small easily defined set of outputs. It gets hairy fast when you have multiple special purpose chips in a system that could do anything.
Money.
Doing this type of research is extremely time consuming so research needs funding, to eat food and pay rent and even if you discover things worth sharing, the current legal system often prevents you from publishing it, which costs more money to fight.
