Live Reverse Engineering

76,106

820

57

Published

Introduction: Live Reverse Engineering

About: I am a photographer, a tinker, an electronics technology engineer, and author; I write short stories and poetry for the love of writing. I started writing poetry in high school over thirty years ago where I ...

I started in electronics before the advent of the internet and most solid state components, so getting datasheets and schematics was not easy for me. Today with manufactures making custom ICs and LCDs for everything from phones to video games, tinkers that salvage components from old electronics are faced with a new challenge. The schematics and datasheets for custom components are just not available. Even though these components can be obsolete by the time you are salvaging the parts you still can’t get the data sheets. This is where reverse engineering comes to play making schematics and datasheets with pinouts on desired components you can’t get datasheets for.

Now I get a lot of electronics out of the waist bin that work, so when you see a component you like don’t just take the component out of the circuit board and expect to find a datasheet for it, sometimes that works and many times it doesn’t. Find out if it works first.

When I wrote my Instructable Salvaging Liquid Crystal Displays, I was asked about pinouts of LCDs.

https://www.instructables.com/id/Salvaging-Liquid-Crystal-Displays-LCDs/

Many of my replies to these requests for pinouts were to tell them to follow my Instructable Reverse Engineering.

https://www.instructables.com/id/Reverse-Engineering-1/

That Instructable works for displays if you can look up the other components on the circuit board, this Instructable is about finding the pinouts when you can’t look up the key components or can’t find the datasheets.

This Instructable will not teach you the codes that make a component work; nor will it teach you how to get past one time programmable ICs or locked ICs. It will teach you how to find some if not all the functions of a components pinouts.

Step 1: Tools

1. Screwdriver to disassemble the housing.

2. Multimeter for checking voltages.

3. Soldering gun for surface mount components you may need two.

4. Oscilloscope for checking signals.

5. PCB holder

6. Safety Glasses

7. Sand Paper

A logic analyzer would be better for analyzing the data inputs as logic circuits function on true current and the signals will look the reverse with an oscilloscope.

Step 2: COG LCD or Chip on Glass Liquid Crystal Display

You may find yourself with a phone like this one and go, “Oh boy what a nice LCD display.” And take the display out only to discover you can’t get a datasheet for the display. If you had the forethought to keep the circuit board so you could reverse engineer the circuit board and you then discover there are four key components you can’t get datasheets for.

The COG LCD 8 pin 1 custom bar 2 X 14 digit 5 X 7 segment alphanumerical bars.

The Transmitter

The eight pin IC L326U79W

The eighty pin IC SC14431

Of these four components I could only get the datasheet for a SC14408 IC and I was not sure if it had the same pinout.

In my case I had three of the same phones so I did a Live Reverse Engineering.

Step 3: Dissembling for Live Testing

Start by charging the battery, I had a number of them so I picked one that held a charge for at least one hour, this phone will not work when you push the buttons while it is charging the battery or without a battery, so I needed a working battery.

To live test you need to remove the circuit from the phone housing. Start by removing the battery cover, and take out the battery and the screws holding the back of the phone housing to the front of the phone housing.

Keep the battery.

Next open the phone housing and remove any screws holding the circuit board to the front of the housing.

Remove the circuit board and the key pad buttons you need the key pad buttons for testing.

Pop the speaker off the back of the housing.

Once you have the circuits, battery, and key pad buttons you can toss the housing into your scrap plastic bin.

Since I did not need the speaker or the earpiece for testing I removed them, if you desolder the connections make sure you do not short the connections with solder.

Last I removed the earpiece bracket to expose the COG LCDs terminals.

Step 4: Meter Testing

Reattach the battery and mount the circuit board into the PCB holder. Start with a Multimeter measure and record the voltages one pin at a time.

Pin 1. 2.8 Volts negative

Pin 2. 0 volts

Pin 3. 2.3 volts positive

Pin 4. 2.3 volts positive

Pin 5. 2.3 volts positive

Pin 6. 2.3 volts positive

Pin 7. 2.3 volts positive

Pin 8. 2.3 volts positive

Step 5: Logic Analyzer or Oscilloscope

A logic analyzer would be best for analyzing the signal inputs but you can use an oscilloscope and record the results to get the same information. Set your oscilloscope for scan at a speed you can see the data stream when you push one of the buttons.

Pin 1. No signal 2.8 Volts negative

Pin 2. No signal 0 volts

Pin 3. No signal 2.3 volts positive

Pin 4. No signal 2.3 volts positive

Pin 5. Signal 2.3 volts positive

Pin 6. Signal 2.3 volts positive

Pin 7. Signal 2.3 volts positive

Pin 8. Signal 2.3 volts positive

Step 6: Display Response

Next check the display response by changing the signal inputs and recording the response. You don’t need to record everything the display does just if it changes or not and if the display goes out. Since Pin 1 is negative voltage and no signal, and pin two is 0 voltage and no signal we can assume they are Vss. and ground.

Pin 3 and 4 are fixed high so start with Pin 5 checking one pin at a time, fix the voltage too high, or in this case 2.3 volts and observe what happens to the display.

Record the response of pin 5 then move to Pin 6 fixing it to high then observe the response on the display and record it. Continue with this process for pin 7 and pin 8. The changes on the display were funky symbols in the alphanumeric segments and random lighting up of the custom bar. You may notice the response only affects the custom bar or the alphanumeric bars make note of that because the pin data inputs may be bar specific.

Starting with Pin 3 start checking one pin at a time, fix the voltage to low or in this case 0 volts and observe what happens to the display. Pin 3 and 4 when set low shut down the display, pins 5 to 8 when set to low or 0 volts made different symbols in the alphanumeric segments, and different random lighting up of the symbols in the custom bar.

What this did was to corrupt the data inputs set the enable to disable and the Vdd. to 0 volts. At this point I know what 6 of the 8 pins are and what they do.

Pin 1. Vss

Pin 2. Gnd

Pin 3. ???

Pin 4. ???

Pin 5. D0

Pin 6. D1

Pin 7. D2

Pin 8. D3

Pin 3 and 4 I suspect are Enable and Vdd. but to find out which is which I will need to trace the circuits.

Step 7: Tracing the Circuits

If you only have one circuit board; take a good photograph of the circuit board before and after you take the components off the circuit board. Since I had three of these phones I had one fully assembled on the charger to keep the battery charged. One phone partially dissembled for reference and one I striped for testing and tracing.

After removing the COG LCD I made notes on the backlight LEDs and removed all the components putting aside the components I wanted.

Remove the ink, paint, and lacquer, covering the circuits so you can see the conductors better. I have tried every compound, stripper, and solvent I could buy in the store, none of them worked at removing the ink or lacquer on these circuit boards. So I sanded the boards clean, photographed both sides and traced the circuits in paint on my computer.

I compared the pinouts of the SC14431 IC with the SC14408 IC datasheet and I was glad I did not rely on the datasheet for my pinouts none of the pinouts from the SC4431 that I knew were Ground, Vss, or data matched with the SC4408 IC datasheet. However I was able to tell which pin on the LCD was Vdd and enable.

Pin 3 went to multiple components denoted by the C in the box until it traced to the positive of the battery.

Pin 4 went to pin 28 of the SC14431 IC only, this told me it had to be enable.

Step 8: Pinouts

Pin 1. Vss
Pin 2. Gnd

Pin 3. Vdd

Pin 4. Enable

Pin 5. D0

Pin 6. D1

Pin 7. D2

Pin 8. D3

There you have a minimal datasheet for an unknown COG LCD connected to unknown ICs with a basic connection schematic using Live Reverse Engineering.

Step 9: Looks Like a Nokia Graphics LCD

Although this LCD looks like a Nokia Graphic LCD it is a custom LCD with two 15 digit alphanumeric bars and two custom bars. Even after I live reverse engineered this LCD I could not find the code to make it do what I wanted. I tried the Nokia graphic codes and pinouts on this LCD using Arduino. The Arduino codes and the pinouts did not work on this Nokia look alike LCD. Do not look at a component and assume it is the same as it looks.

Step 10: The Circuit Board

Unlike the first phone in this Instructable the only parts I could not find datasheets for were the transmitter, LCD, and the one resin coated IC.

Step 11: Live Testing With a Meter

Just like the first phone I exposed the LCD terminals and checked the voltages with a multimeter. Recording the voltages I found voltages twice that of the battery.

Pin 1. 3.3 volts when button pushed.

Pin 2. 3.3 volts.

Pin 3. 3.3 volts when button pushed.

Pin 4. 0 volts.

Pin 5. 3.3 volts.

Pin 6. 6.17 volts.

Pin 7. 6.17 volts.

Pin 8. 3.3 volts.

Pin 9. 6.17 volts.

Step 12: Live Testing With an Oscilloscope

On this circuit board with the oscilloscope I got two intermittent signals and three constant signals.

Pin 1. Signal when the button was pushed 3.3 volts.

Pin 2. Constant square wave 3.3 volts.

Pin 3. Signal when button pushed 3.3 volts.

Pin 4. No signal 0 volts.

Pin 5. No signal 3.3 volts.

Pin 6. No signal 6.17 volts.

Pin 7. Constant square wave 6.17 volts.

Pin 8. Constant square wave 3.3 volts.

Pin 9. No signal 6.17 volts.

Step 13: Tracing the Nokia Look Alike Circuits

Just like the first circuit board I took photos removed the parts made notes on the backlight LED and cleaned the circuit board to trace the conductors in paint on my computer. Once I had the circuit feeding the LCD I had all the pinouts but the one to the resin coated IC and it was not hard to deduce it was reset or enable.

Pin 1. Resin coated IC.

Pin 2. Serial clock on IC AMTH 004.

Pin 3. Serial data on IC AMTH 004.

Pin 4. Ground.

Pin 5. Vcc.

Pin 6. High voltage and a capacitor to pin 5.

Pin 7. High voltage square wave and a capacitor to pin 8.

Pin 8. Low voltage square wave.

Pin 9. High voltage.

Step 14: Nokia Look Alike Pinouts

For the last little bit I disassembled the LCD making notes of its construction and made a simple datasheet with a connection circuit.

Finding the pinouts of a component is not impossible without a datasheet when you use reverse engineering, but datasheets do make life easer.

Last you will find coding a challenge because it is; 10010100 is 42 or the alphanumerical sun of "To Be". The answer to life, the universe, and everything.

Phone Contest

First Prize in the
Phone Contest

Soldering Challenge

Runner Up in the
Soldering Challenge

2 People Made This Project!

Recommendations

  • Clocks Contest

    Clocks Contest
  • Oil Contest

    Oil Contest
  • Casting Contest

    Casting Contest
user

We have a be nice policy.
Please be positive and constructive.

Tips

Questions

57 Comments

Offline reversing tips:

Manufacturers often put Vcc and GND on the very left or right pins of connector, like pin 1 and 2.

I like this instructable

but I want to know that I have 10" tablet and the motherboard of tablet is burned but lcd is good now I want to make 10" lcd tv using my tablet lcd

can you help me for that

1 reply

appreciate your dedication to this very detailed instructables.... :)

1 reply

appreciate your dedication to this very detailed instructables.... :)

It's rare to see an instructable that teaches so concisely. Well done, sir. :)

2 replies

On that circuit board there is a ground test terminal I used it the first time I tested the circuit board. All the grounds in that circuit board connect to the same ground, battery, ICs, Charger and LCD. it is the wide flat copper that almost covers the entire board other than the conductors you can see in the tracing step of this Instructable so to take the photos for the Instructable I just connected my meter to the charger ground terminal for ease of holding my camera.

My oscilloscope I connected to the same ground the first time and the LCD ground the second time I checked the data inputs and held my camera.

This is a really well done Instructable! Great job - thanks for taking the time to list all of the steps.

1 reply

Are you sure that is the right LCD AUO024B2GC the specks on that page say it is for a camera or MP3 MP4.

At any rate I do not have the datasheet nor have I had the chance to reverse engineer it.

hi, yes sure. mi issue here, is that it has a lot of pins, more that my 40 years eye can see...

lcd.jpg

Very good, thanks for taking the time to share all this info. It helped a lot.

1 reply

Hi Josehf,

Thanks for the detailed info. You've obviously spent a lot of time and hard work getting this info. I have a few small LCD panels lying around. I never knew how to use them and now I can at least make a start.

Here is my experience for people who are looking for info on 7" LCD colour panels:

I played around a bit with 7" colour LCD panels and found that as long as the cable width is the same they can be interchanged. I found an old digital photo frame with a cracked panel. I changed the panel for a much newer version. The only difference was that the old panel had a CCFL tube backlight while the new one was LED. No problem - I just looked for a 12V source on the board to drive the LEDs. It's still working.

Another encounter was with a 7" tablet. It was a very new model. It must have fallen from a height. The LCD panel was shattered and the battery had a hole in it, but the board was intact. I couldn't wait to check my cable width theory. The LCD panel from my old, dead tablet fit the connector on the board perfectly. When I powered on it did work, full screen, backlight and all, but only 3/4 of the picture was displayed. It seems the resolution of the original panel was much higher. At least, I know that the board is OK and If I get my hands on another dead tablet, I can try to get the panel working on the board.