Show HN: Reverse-Engineering a Switch Lite with 1,917 wires

I don’t have any direct experience to suggest, but for your funding model you seem to be mostly concerned that you wouldn’t make much money after releasing the work due to piracy. Perhaps you could consider the crowdfunding model instead, collect the money first! It also has the benefit of implicit voting for most-wanted projects.

This model would be similar to the notorious Denuvo DRM cracker Empress, who is essentially the only person who can break this gaming anticheat. https://en.m.wikipedia.org/wiki/Empress_(cracker) . I will warn they have quite some drama about them, but the financials seem to be working.

I would also consider what your work could be useful for / value proposition for others. The trimmed-down Wii consoles come to mind. Perhaps a small group of people would heavily value a netlist of their favorite circuit that they could recreate even smaller with more layers/modern techniques.

great project! i ran into it the other day and was impressed with the number of wires.

i've been reverse engineering PCBs (mostly 2-4 layers) for a few years now and this is a part of the problem that i've been thinking about how to solve. best i can think of is a flying probe station cobbled together from 3d printers. basically you'd 1) scan the top and bottom of the board 2) generate a list of test points and pads 3) feed the coordinates into the flying probe system to generate the netlist

the other way to handle multilayer boards (and the most accurate, imo, because it captures exact ground plane designs, guard traces, and structures like that) is the scan-sand-scan approach. you'll get exact artwork--unfortunately the dust it generates is pretty nasty stuff.

I feel like contacting Louis rossman from YouTube for an interview on right to repair etc would be great!

I'm wondering if a 'bed of nails' approach could be used to eliminate the mechanical difficulty of the flying probes? Basically a grid of (many thousands) probes at some resolution, connecting to essentially the same switch matrix backend you already have.

In particular something like [1] might just have enough resolution. The 'probes' now are just pads on the sensing PCB. This converts it from a mechanical problem to a crazy high density PCB layout problem, which sounds like it'd be up your alley!

Heat cure for the anisotropic layer is annoying, and might make it a single-use solution (but that's not bad if you're selling the boards!)

Another 'just dumb enough to work' concept would be to take the board scans, and print a custom PCB of the same pad layout mirrored, and you can directly mount the two boards face-to-face. Basically a board level breakout, either to make the wire soldering easier, or better, again directly incorporate the netlisting hardware.

[1] https://www.3m.com/3M/en_US/p/d/b5005076018/

You’re right, but I don’t want to solder 2k wires to things. Last time I “professionally” reverse engineered a board we sent it out to get a CT scan of it, and got delivered a self executing program which contained a point cloud of data and an interface to extract surfaces, adjust the histogram (to make features visible) etc.

I’d take a handful of automated probes in a 3D printer chassis, and some vision/registration/classical computer vision algorithms.

This type of thing already exists but I’d rather have an open source one.

Quick creation of a Openseadragon viewer of the PCB from the article: https://ha-norge.no/images/pcb_highres/highres_pcb.html

Full resolution on mobile phone without the need for downloadning 124MB JPG. The image consist of layer with different resolution, and a lot of tiny pictures (+ 45.000). Enjoy.

I think I got most of the jargon, but what is a “binned location”?

Wow I would've loved to have something like this. In the last few months I tried reverse engineering a Dell server motherboard (just the power supply interface) and a Lenovo ThinkCentre motherboard (PCI-E riser) and its such a pain to do by hand I mostly gave up after figuring out some basic connectivity.

It's not really clear to me what your goal is here. It seems like this would make for a great open source project. Even if you want to make money from it, I think you can generate a lot of value from the process rather than the tools (which only you can really use anyway).

You mentioned in a comment below automating the process further like a bonding machine. There's been a ton of work in this general space in a mechanical sense for 3D printers. I bet you could fairly easily adapt it for probing.

Regarding industrial espionage on PCBs, would you say most are out of China?

Soldering required here is _INSANE_. There are industrial flying probe machines that can perform same task in fully automated manner with no soldering, but typical Chinese RE involves sanding the board down one layer at a time https://www.chinapcbcopy.com/pcb-reverse-engineering/

There are Chinese outfits offering this service at really low prices, we are talking hundreds of dollars per pcb.

https://www.pcb-hero.com/blogs/lilycolumn/pcb-reverse-engine...

https://www.chinapcbcopy.com/pcb-clone-service/

https://www.pcbtok.com/pcb-reverse-engineering/

Do you have a full time job? Do you have young kids?

I am guessing one of these is a "no", probably the later.

If I am wrong, please tell me the secret

This is amazing (particular the hand soldering - I love the genre of "this is impossible, you'd need to do this thing thousands of times" "so I did the thing thousands of times" persistence) but I wonder, now that homebrew pick-and-place is starting to become a thing, is there any practical way to take advantage of that? I pick-and-place tip that was vaguely like a wire-wrap tool seems almost plausible. Or is this more like bond-wires on chips and needs an order of magnitude more precision?

This seems like a lot of effort to get a net list given other techniques to deduce what pads are connected (e.g. knowing the most connected net is the ground plane, looking up the pinouts for the ICs, looking at the voltages and signals when the board is powered).

Did you take a panorama of the board after desoldering all the components? I'm curious (although not likely to want to dedicate more than minimal time to) if it would be possible minimize/eliminate your innovation #2 by using computer vision.

Or are you maybe aware of other images of depopulated boards?

Isn’t crosstalk an issue ? Just wondering

If you / somebody is doing the sand and scan or xray/CT method (which you could pay somebody to do rather than buying a CT machine), then you can create a gerber -- then manually clean it up. Then you have a dangling set of nets that are only separated by layers. You can then infer connectivity from the gerbers on layer to layer manually again to create a reduced set of nets by the shape / visual cues of what the vias look like. That would be far easier than soldering wires to every ball on both sides of a board -- and a netlist doesn't automatically generate a schematic for you, you need to still do a chunk of work to actually create the schematic. To be honest, a netlist is not actually all that useful unless your goal is to attempt to create a full schematic out of the board. For reverse engineering efforts, you would likely focus on one chip and just manually follow each trace for the thing you care about and draw up a schematic manually for that. In most cases you would likely spend like 1 day after you got the scans back building up a schematic for the key chips of interest. For anything that is a bit questionable about if a via actually connects or not, then you would just manually ohm that out. Anyway, I guess if you like soldering and are just doing something for fun, then sure do this method. Otherwise, there are way better approaches than this.

If the goal is to just make money, I could sell 6,000 PPI panoramas of women's feet as NFT's. Note: Do not contact me about this.

Lmao.

PCB RE services are pretty cheap in China and the far East, and they use a lot of automation to do the work of creating the netlist from the pad locations --- the recognition and probing is automated.

Your brute-force approach to finding hidden connections is simple but brilliant. I know a lot of current hobbyist reverse-engineering efforts have to go a lot further, are destructive and involve sanding things off layer-by-layer (resulting in 1:1 reconstructions, rather than just board views), but I'm sure that gets harder and harder the more PCB layers are involved, especially with cutting-edge consumer tech.

Such a great project, really enjoyed it. I’m a hardware engineer. I really appreciate this

It's definitely a really cool project, but this doesn't really look like something that would scale. While a boardview is nice to have, investing what looks like hundreds of hours per board simply isn't viable for the vast majority of projects - especially the hobbyist market you seem to be targeting.

You can get something similar-ish done quite cheaply in China: a digital copy of a 2-layer board is only $150[0], and turning that into a netlist shouldn't be too difficult. I expect multi-layer boards to be quite a bit more expensive, but still nothing like this process.

Heck, even for a plain netlist it'd probably be orders of magnitude easier to DIY your own flying-probe machine. All the hardware for 3D printers is widely available, after all.

[0]: https://dirtypcbs.com/store/pcbclone

This is completely brilliant!

If the painful part is the soldering, and the novel part is the imaging, there is definitely opportunity here. Seems like an opportunity to create a dirt cheap flying probe based off an ender3 3D printer. This is possibly a perfect situation where smart software can make up for the shortcomings of cheap hardware.