Reverse Engineering Serial Ports devtty. S0. Given the name of this blog and the number of requests that Ive had, I think its high time we discussed serial ports specifically, serial ports in embedded systems. My goal here is to describe the techniques that Ive found effective in identifying and reverse engineering embedded serial ports through the use of definitive testing and educated guesses, and without the need for expensive equipment. Check Serial Port On Linux' title='Check Serial Port On Linux' />This document is for the UART serial port. This port has mostly disappeared from desktops and laptops is still used elsewhere such as for embedded systems. PL2303RA provides a convenient solution for connecting an RS232 fullduplex asynchronous serial device to any Universal Serial Bus USB capable host. In computing, a serial port is a serial communication interface through which information transfers in or out one bit at a time in contrast to a parallel port. Introduction. Serial ports are extremely useful to embedded developers, who commonly use them for Accessing the boot loader. Observing boot and debug messages. Interacting with the system via a shell. Needless to say, this functionality is also useful to hackers, so finding a serial port on an embedded device can be very advantageous. As a case study, well be examining the PCB of a Westell 9. EM Fi. OS router for possible serial ports Westell 9. EM PCBNow, these arent your dads RS 2. Universal Asynchronous Receiver Transmitters UARTs, commonly found in embedded devices. Although protocol compatible, RS 2. UART are not voltage compatible from here on out I will use the terms UART and serial port interchangeably. UARTs most commonly operate at 3. Linux Parallel Port Code. Below are listed two options for controlling the parallel port under Linux. The first option writes directly to the parallel port memory. The serial port communication programs moserial or gtkterm provide an easy way to check connectivity and modify devttyUSB0 or devttyUSB1 settings. Features. PIC16F87x serial bootloader. Used successfully by thousands of users worldwide. Compatible with the 16F87013467 and 16F876, 16F876A, 16F877, 16F877A. Port USB DB9 Serial Adapter Solution for Windows 98ME2000 and XP from 109. Check Serial Port On Linux' title='Check Serial Port On Linux' />Unfortunately there arent any industry standardized UART pin outs, and manufacturers dont often go around advertising or documenting their debug interfaces, so well need to do a bit of work in order to interface with these serial ports. Specifically, we need to reverse engineer both the hardware interface and the software protocol settings. Lets start with the hardware interface first. For this, youll need a multimeter and a pair of eyeballs or even one will do just fine. Yes, oscilloscopes and logic analyzers are useful and sometimes necessary, but 9. Identifying Serial Headers. The first step is to try to identify potential candidates for serial port headers. Most serial port headers have at a minimum four pins Typically youll want to look for a single row of 4 6 pins, although this is not a hard and fast rule and they can come in any pin configuration the manufacturer has decided on. Key Windows 8.1 Pro Build 9600 on this page. On our 9. 10. 0EM PCB we find two possible candidates, labeled P1. SerialPort-Read-String-Received.jpeg' alt='Check Serial Port On Linux' title='Check Serial Port On Linux' />P1. Possible serial port headers. Sometimes you wont have a nicely broken out set of pins like this, and youll have to examine test points on the board usually starting with test points closest to the So. C is a good idea. Here is an example of a serial port exposed via test points on a different board, the WL5. G Serial port test points on a WL5. GIn either case the process of pin identification is the same, but usually takes longer if there is no header since there will likely be more than 4 test points on the board that you will need to examine. At this point either P1. P1. 40. 4 could be serial port headers. Or they could both be serial port headers. Or neither could be a serial port header. So well examine the pins on each header individually to try to gain some insight. Visual Inspection. First, lets visibly inspect the pins. Well start by taking a look at P1. P1. 40. 2 top. P1. On the top layer of the PCB the right most pin is labeled as pin 1. This is not terribly important, but it gives a common frame of reference when describing the pin numbers. On the bottom of the PCB we see that pin 3 has four traces in a crosshair pattern that connect it to the surrounding ground plane. This easily identifies pin 3 as ground. Pins 2 and 4 have thin traces connected to them, while pin 1 is connected to a fatter trace. Wide traces are typically used for supplying power, while narrow traces are usually used for signal traces. This suggests that pin 1 is Vcc and pins 2 and 4 are potentially transmit and receive although we dont yet know which is which. Lets take a look at the P1. P1. 40. 4 top. P1. Here, the left most pin is marked as pin 1. Again, we see that pin 3 is connected to ground on the bottom layer of the PCB. Pin 4 also has a thin trace connected to it, so it could be a transmit or receive pin. The other two pins of P1. PCB. It could be that they arent connected to anything, but more likely their traces are connected on one of the inner layers of the PCB that we cant see. Time to break out the multimeter. Identifying Grounded Pins. A continuity test introduces a small current into the circuit if enough current passes from one probe to the other i. The first thing we want to do is perform a continuity test between ground and all the pins on each of the headers using the multimeter. This will tell us which pins are connected directly to ground. Well start with P1. Metal shielding is a convenient ground point to use for testing. Placing one probe on a shield and touching the other to pin 3, the multimeter emits a continuous audible tone, indicating that pin 3 is connected to ground as we previously observed Continuity test between pin 3 and ground. Performing the same test against pins 2 and 4 results in no audible tone, so we know those pins arent grounded. The same continuity tests for P1. Thus we know that for both P1. P1. 40. 4 pin 3 is grounded and pins 2 and 4 are not. Identifying Vcc. Vcc is less important to identify since we dont actually need to connect anything to it, but locating the Vcc pin is a good exercise and is useful in eliminating the Vcc pin as a possible candidate for transmit or receive. Based on the trace widths, we suspect that pin 1 is Vcc measuring the voltage on pin 1 when the board is powered on appears to confirm this Measuring voltage on P1. A steady voltage reading on P1. The same voltage readings hold true for P1. P1. 40. 2 and P1. Vcc. Another method of identifying Vcc is to perform a continuity test between ground and the suspected Vcc pin. Although it may first appear counter intuitive, this will commonly result in a very short beep though not a continuous tone. What happens with the Vcc continuity test is that there is usually a filter capacitor connected between the Vcc pin and ground. This is done to eliminate any possible noise in the power lines on the PCB, and such filter capacitors are used liberally in any well designed board. 2004 Columbia Edition Jeep Liberty. Due to the nature of how capacitors work, they will pass a direct current very briefly until they are charged to capacity, at which point they will cease passing direct current and will block direct current, resulting in the short beep observed during the continuity test it is worth nothing that current doesnt actually pass through a capacitor, although it appears that way to an outside observer. Although it doesnt always work, the continuity test is a more conclusive method of determining Vcc than simply measuring the voltage on each pin, as any number of pins could all read the same voltage. Note that you will also need a multimeter with a rather responsive continuity tester in order to perform this test properly cheaper ones can take up to a second or more before they are triggered, at which point the capacitor has already been charged. Most multimeters in the 1. Identifying the Transmit Pin. The transmit pin is fairly easy to identify provided that the serial port is active and is transmitting data and if its not, this entire effort will likely be futile anyway. The transmit pin on the board will be pulled high to the same voltage as Vcc typically 3. As it transmits bits of data, the voltage will drop to 0 volts to send a space, then back to 3.