Help me reverse engineer this FPGA board! - Page 1
Forum section: electronics / projects

author: nth_degree
author_rank: Regular Contributor
timestamp: March 26, 2018, 09:39:00 am
content: Hi all,So I've been wanting for some time now to reverse engineer PCBs w/ large FPGAs. It's tough to know where to start. I found one I think will be easy to start with take a look;https://photos.app.goo.gl/MMlswYn9sFCBxyGC3My impressions areJTAG left sideLinear based power distribution on the boardGPIO broken out from headers on the undersidepower input to the right CN2 and possibly left, white connectors. How to discover is the polarity and voltage?CN12 top left is clock inputdip switches control what SPI is loaded into FPGAs?removal of CN14 SATA connector on the left may allow for discovering the transceiver addresses with SUMP logic analyzer and knowing that allow for guessing of the address of the SATA port below.how can I figure out the GPIO address of the Micron memory without removing from the board?How much will I need to remove to discover the logic layout?Would an Xray be worthwhile? I can get it done perhapsShould I just remove the Kintex part and make my own board? Is it crazy to try this?I would love to hear your thoughts and advice!

author: abraxa
author_rank: Frequent Contributor
timestamp: March 26, 2018, 09:50:21 am
content: I'd say this is virtually impossible without an x-ray picture because of the BGA and the multi-layer PCB. Even then, I'd consider it serious effort. So my question is: why do you want to do this and what's there to gain from it?

author: nth_degree
author_rank: Regular Contributor
timestamp: March 26, 2018, 09:59:03 am
content: Well I want to reverse engineer much more complex designs so would be useful to get the skills and see whats possible on a simpler board configuration.One thing I see now is that the high speed traces for the transceivers are visible on the underside. You can see where the FPGAs interconnect, and the location of the transceivers for the SATA, and the traces to the reference crystals. Hmm

author: nth_degree
author_rank: Regular Contributor
timestamp: March 26, 2018, 10:02:17 am
content: I'm going to look up every IC and read the datasheetAll that's required is to get it the correct voltage, hook up to JTAG, run a chain scan, run a boundary scan hopefully w/o damaging the IO. Then guess the location of memory IO and the transceivers. The transceivers are basically given to us, at least.... I say 4 pair interconnect FPGAs and 2 pair go for SATA. I can breakout those from the SATA ports. If they use transceiver between FPGAs then GPIO is likely rationally broken out over the headers on the underside. I hope...

author: daveshah
author_rank: Unknown
timestamp: March 26, 2018, 10:15:20 am
content: The memory is going to be difficult. Xilinx 7-series parts don't have dedicated DDR3 pins (only dedicated DQS pins), so I don't see a good way of working it out. But figuring out JTAG, power and transceivers should be doable - unless the FPGA is very locked down...

author: dmills
author_rank: Super Contributor
timestamp: March 26, 2018, 10:20:51 am
content: Start with power, then see what JTAG has to say, those LTM modules will probably reveal much from the datasheets and should give you a hint as to what external power is required, then boundary scan to figure out some of the internal connections (Particularly useful for connections between the FPGAs).There are labelled test points that will be very useful to you.DRAM will be a pain as you do not know the appropriate settings, but if you run it relatively slowly you might be able to find a workable setup.Personally I would not bother these days, but whatever works for you I guess.Regards, Dan.

author: KE5FX
author_rank: Super Contributor
timestamp: March 26, 2018, 10:35:38 am
content: Interesting board. What'd it come out of?Whoever designed this puppy was not suffering under the illusion of a budget.

author: TK
author_rank: Super Contributor
timestamp: March 26, 2018, 10:36:01 am
content: Take a look to one of the digilent FPGA boards and study the pictures and the published schematicsdigilentinc.com

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 26, 2018, 11:38:27 am
content: Boundary scan worked for me on a smaller (Spartan 6) board. Some key moments:- get the fpga to unconfigured state (i’ve just disconnected the PROM, but there ashould be other ways like keep PROGRAM_B low or backup and erase the PROM)- preload the chain with values setting everything possible to input mode- do several scans w/o touching anything to find pins that change on their own (oscillator inputs), filter them out- scan in a loop detecting the changes, touch everything possible with a needle probe equipped with a button switching the needle from moderate pull up to stronger pull down, document the observationsI did this using an FT2232H-based JTAG dongle and my own quickly coded SW, but there exests some nice tools for this.Spartan 6 has dedicated SDRAM pins so for me it was enough to touch some termination resistors around the SDRAM to figure out the MCB used. In the worst case you can have the SDRAM desoldered temporary to touch it’s signals.