Reverse engineering - Page 1
Forum section: electronics / general

author: Hardcorefs
author_rank: Regular Contributor
timestamp: April 05, 2013, 07:05:41 am
content: Hi,I have a 16 layer PCB to reverse engineer, fortunately I have a scrap one I can destroy.What is the best way to split the layer out, so that i can scan and reassemble?

author: TerraHertz
author_rank: Super Contributor
timestamp: April 05, 2013, 07:57:18 am
content: Wow, you really are hard core.I've successfully reverse engineering 4 layer boards, even where the inner layers contain some tracks.Currently doing one that is an Argon laser controller, 4 layers, multiple boards.But 16 layers?If anyone can answer that, I'd like to hear it too.Automated point-to-point resistance measurement, of all possible endpoint combinations, and software to derive the netlist, maybe?I just can't think of any method that might be able to cleave or grind down the PCB layer by layer, and not 'lose' any tracks.

author: poorchava
author_rank: Super Contributor
timestamp: April 05, 2013, 08:57:14 am
content: There are companies that specialize in that kind of things. They lay the pcb flat on a perfectly flat surface, scan at high resolution and then polish the pcb until next layer is visible enough, so that it can be scanned. But that requires a high precision and very expensive equipment not to mention a lot of expertise and experience.I think you would be better off outsourcing that task.

author: Balaur
author_rank: Unknown
timestamp: April 05, 2013, 09:10:09 am
content: If you still want to do this, try to talk to machinist guys that do car engine block/head resurfacing with a modern milling machine. They will be able to "open" your PCB mil by mil.You may not like the price though, since it will certainly involve multiple passes.Maybe you will have to glue your PCB to a flat sheet of metal for better rigidity and support during the process?

author: KJDS
author_rank: Super Contributor
timestamp: April 05, 2013, 10:13:06 am
content: I've taken a conventional mill to a multilayer board a few times. The inner layers can end up a long way from flat. It's often difficult to remove most of a dielectric layer without taking off some of the next layer of copper.I've got to wonder why you'd want to copy a sixteen layer board. It's surely cheaper just to buy a replacement.

author: AndyC_772
author_rank: Super Contributor
timestamp: April 05, 2013, 10:43:47 am
content: It's a trap I've seen companies fall into when they outsource the design of a board to the same company that will be making or supplying them. The manufacturer refuses to supply the design data for the PCB and thereby forces the customer to only ever buy from them. The customer is effectively held to ransom and has no choice but to buy from that same source, whatever the cost, quality or lead time.It's an incredibly stupid policy for a manufacturer to adopt, of course, because it guarantees that they'll never get any future design work. But nevertheless, it does happen.Unless the board is highly specialised - an RF design requiring a great deal of specialist knowledge, perhaps - I'd expect it would be cheaper, easier and more reliable to get a layout bureau to design a new board from scratch. Drop me a PM if you'd like a recommendation.

author: mswhin63
author_rank: Frequent Contributor
timestamp: April 05, 2013, 10:48:25 am
content: I dont really reverse engineer much, but to look at such a multilayer board I would look at each chip and the datasheet then look at the standard circuit configurations for each chip and see where they could go together.I would leave the continuity testing till last.

author: amyk
author_rank: Super Contributor
timestamp: April 05, 2013, 10:57:43 am
content: Depopulate-and-probe is the usual method they use to recover the netlist. If there are N pads on the board there is no need to probe all O(N^2) permutations since each net is separate and once you've identified all the pads on one net, they essentially disappear from the board and you're left with much less (especially in the case of power planes.) Of course this assumes your board is a working specimen without any broken traces or shorts.QuoteThe fact that it's got so many layers suggests it's in a specialised application.

author: Gall
author_rank: Frequent Contributor
timestamp: April 05, 2013, 04:14:22 pm
content: One more hint: if the device is functional and the ICs have JTAG ports on them, it may be possible to scan the comnnections automatically using JTAGs.

author: Balaur
author_rank: Unknown
timestamp: April 05, 2013, 04:49:36 pm
content: Quote from: Gall on April 05, 2013, 04:14:22 pmIf you are talking about the boundary scan, then it's not exactly trivial to implement and use. At least, you'll need specific configuration files for each device. Then, this feature will only/mainly test connections between devices connected in the same JTAG chain.The time, effort and expertise associated to this is vastly superior than just probing the pads with a continuity tester.

author: Gall
author_rank: Frequent Contributor
timestamp: April 05, 2013, 04:57:34 pm
content: Quote from: Balaur on April 05, 2013, 04:49:36 pmYes, I mean boundary scan. Of course it is usually hard to do but it is doable. If the board is very complex it may happen to be easier than hardware tester, if the tester is not automatic.Even if the devices aren't connected to the same JTAG chain, it is still possible to scan the connections by wiring multiple JTAG adapters to the same PC. However this would need extra programming and is suitable only for those who has skills in mathematics and algorithm building techniques.

author: codeboy2k
author_rank: Super Contributor
timestamp: April 05, 2013, 07:24:28 pm
content: Quote from: amyk on April 05, 2013, 10:57:43 amI'd love to see a bed of nails device, top and bottom, with a fine grid of probes in X-Y configuration, say 6,8,10 mil spacing of the probes, plunge it down onto a depopulated board, top and bottom at the same time, and probe the netlist simultaneously with some software on a PC. Speed it up with multiple PCs sharing the work.Is it done this way already, or do people reverse engineer by hand probing the nets?

author: peter.mitchell
author_rank: Super Contributor
timestamp: April 05, 2013, 08:06:54 pm
content: I'd be tempted to get some 3000+ grit sandpaper, affix it to a flat surface (eg, glass plate), affix pcb to flat surface, slowly grind it down, taking pictures as you go, i'd probably wear a mask for this.

author: Hardcorefs
author_rank: Regular Contributor
timestamp: April 06, 2013, 12:13:59 am
content: K....most of the other solutions won't work......It is 220mm*150mm with two 600 pin FPGA's, 4 memory chips 3 CPU's+misc on it.Looks like a de-populate and a hot iron then.....

author: Hardcorefs
author_rank: Regular Contributor
timestamp: April 06, 2013, 12:19:55 am
content: Quote from: Balaur on April 05, 2013, 04:49:36 pmAnd JTAG specific requirement is that you have a 100% working PCB that you can 'bring-up'.The PCB is specifically designed to 'prevent' it from being brought up unless it is in its enclosure, and then if it is not signaled correctly it brings up the Switch modes in the wrong order burning out masses of components.......

author: codeboy2k
author_rank: Super Contributor
timestamp: April 06, 2013, 05:27:53 am
content: Quote from: Hardcorefs on April 06, 2013, 12:19:55 amOP works for the Dept. Whose Name We Dare Not Say in the Gubernment

author: amyk
author_rank: Super Contributor
timestamp: April 06, 2013, 10:35:49 am
content: Quote from: codeboy2k on April 05, 2013, 07:24:28 pmYes they do:http://www.seica.com/di/c/cd/Rassegna%20Stampa/Redazionali/Flying%20Prober%20for%20Reverse%20Engineering%20-%20Lingua%20inglese.pdf

author: free_electron
author_rank: Super Contributor
timestamp: April 06, 2013, 03:47:22 pm
content: Depopulate board.Find out if there are stacked and or blind vias present.If not : drill out every via hole : delaminate board ( heat to 180 degree so the resin weakens and peel apart. )If you are dealing with laser drilled, blind or stacked via : 3d MRI scan is your friend. There are companies doing that.

author: Hardcorefs
author_rank: Regular Contributor
timestamp: April 07, 2013, 04:15:27 am
content: Hi,yep it is both blind and stacked, some are even UNDER the IC SMD pads, which would mean solder wicking the whole pcb, even a small SMD FET for the buck converter has over 20 Micro vias, possibly laser drilled( there is just no way you can get a drill bit that small with THAT accuracy)My friend is a radiographer, maybe I can get a freebie Xray & MRI scan done?Anyway I now know that 180 deg.. is the target temp to split the layers.But it is def. 16 layer, because there is a small 2cm window that shows a number for each layer and with a very strong halogen 1-16 appear in the window....

author: Jane
author_rank: Frequent Contributor
timestamp: April 08, 2013, 03:12:47 pm
content: Does anyone know prices and places for MRI scan?

author: TerraHertz
author_rank: Super Contributor
timestamp: April 08, 2013, 03:33:07 pm
content: Quote from: codeboy2k on April 06, 2013, 05:27:53 amHa ha, not necessarily. When FPGAs had just arrived, and Xilinx 2064s were the shit (called LCAs then) I did a protected 6502 gaming board for some people. Encrypted code in an EPROM, with the LCA between the EPROM and the CPU, decoding it on the fly. I found that processor emulators all accessed the bus quite differently to what a real CPU did. Scanning through memory, stopping, and so on. So I added an 'emulator detection' circuit to the FPGA. If someone tried to run the board with an emulator plugged into the CPU socket, the LCA (sorry, FPGA) would pit a large number of H logic outputs against a large number of L outputs on an internal tristate bus. Blowing itself up instantly. Those things were pretty expensive back then.I wish I'd been able to watch someone struggling to work that one out.Quote from: Jane on April 08, 2013, 03:12:47 pmMRI scan of what?I don't think MRI will work if there are conductive traces present. They would develop induced currents from the RF field, producing local distortions in the DC magnetic field gradient. Which the MRI process depends on being well controlled, or it can't tell _where_ the atoms are that are precessing at particular rates as the RF field is removed.Quote from: Hardcorefs on April 07, 2013, 04:15:27 amWhy do you care which pads have vias? Just probe every pad to every pad to build a netlist.It occurs to me that if you're doing this for money (let's hope so) a second hand pick&place machine, or perhaps a 3D printer frame might be worth modifying to do the probing under software.I guess the worst problem is the need to probe all permutations on both sides combined.QuoteCare to share what you found on that? Like,howto do it?QuoteHeh... and if someone was really trying to obfuscate the board, those numbers will be wrong. Missing layers, duplications, out of order... I know I would do that.

author: Balaur
author_rank: Unknown
timestamp: April 08, 2013, 03:54:44 pm
content: Quote from: TerraHertz on April 08, 2013, 03:33:07 pmNice stuffI've met a poorly-designed in-house ASIC tester constructed around a FPGA, with a flock of onboard supply (implemented using 5A+ POLs).While it was perfectly possible through software to add multiple internal sources for individual pins, it wasn't this issue that broke the tester.The POLs were there to deliver the required power for the Device Under Test and the FPGA I/Os banks. A particular bug in the user control application made them happily deliver 12V on everything. Yay!Also, because of the poorly-chosen POL package that made them particularly difficult to be soldered correctly to the board, the POL sense pin wasn't always connected. Yay!

author: TerraHertz
author_rank: Super Contributor
timestamp: April 08, 2013, 04:36:10 pm
content: Speaking of obfuscated multilayer PCBs, I have a funny story.I was working in a team, that was developing a complicated 'ink jet printer' - one that would print continuously on huge industrial rolls of expensive cloth. It was just prototyping - if it got anywhere the technology would go over to Japan to the Jap. partner in the project.There were several of us, each doing different boards. The head of the project took on the main DSP board, which used some AMD bitslice, I forget which number. Anyway this guy was French, and paranoid. His design was two or three large boards sandwiched together with connectors. Each was 4 layer: 2 internal for GND & PWR, and signals on the outside.When he had the first version ready to send the gerbers off to a PCB manufacturer, he decided to be clever. His design was so brilliant, he was sure someone would want to copy it. So he obfuscated it. By swapping the inner and outer layers. He thought the result would be just power planes on the outside, tracks hidden on the inside, and it would work just the same, except no one could ever copy the traces.Ha ha ha... so funny. When he got the boards back, the flaw in his brilliant plan became apparent.All the through holes for ICs and components, that should have had pads so you could solder them, just had tiny holes. Sure the holes had copper plated cores, and the plating was in contact with the inside layer pads and tracks. But you try soldering to a plated via with no surface copper!He tried to pretend it wasn't a disaster, but everyone was laughing. Not the Japanese though.Then there's the next stage.Well, he eventually got all the ICs soldered in. Tried to power it up. Dead short between power and ground... somewhere. Now how do you find that, inside such a board? He was stumped.I fixed that problem. Fortunately he had spare, bare PCBs. I took one set home, soldered straps to the two outside power planes, connected my arc welder to them, and flipped the welder power on. BANG! Small spot at one point on the board develops a bubble. That's where the short was, in the inner layers.A little cut-work, and that problem was removed on the populated board. But the best was still to come.Multiple boards, with common processor bus across all boards. A very wide bus, I think 32 bits each A and D.And he'd somehow forgotten to add the bus ports so some pages of his multi-sheet schematic, then never checked the netlist, and then auto-routed it. Geese. So a lot of the bus just didn't connect between boards. Totally not patchable.Well, no one ever wanted to copy his design.Always check the damned netlists.

author: codeboy2k
author_rank: Super Contributor
timestamp: April 08, 2013, 11:13:21 pm
content: Quote from: TerraHertz on April 08, 2013, 03:33:07 pmbut at least you got to see it work in testing.QuoteI've never had an MRI, but I think the idea of an EM field strong enough to align the nucleii of all the atoms in my brain for a brief instant like little soldiers coming to attention all at once... well that seems like something that can't be too good, no matter how much they tell me it's safe.

author: lgbeno
author_rank: Frequent Contributor
timestamp: April 09, 2013, 12:05:47 am
content: MRI scan??? Do you mean X-ray?

author: BravoV
author_rank: Super Contributor
timestamp: April 09, 2013, 12:21:50 am
content: Quote from: lgbeno on April 09, 2013, 12:05:47 amNope, different from X-ray, MRI = "MagneticResonance Imaging"

author: TerraHertz
author_rank: Super Contributor
timestamp: April 09, 2013, 06:43:10 am
content: Quote from: codeboy2k on April 08, 2013, 11:13:21 pmHeh. Yeah. I was proud of myself. I only had to blow up a couple before I was satisfied the emulator detector worked, and wouldn't blow up FPGAs randomly in the field.QuoteWhy?Having had several MRIs and multiple X-rays in recent years (and knowing the theory) I'm happy with MRIs, but seriously try to avoid X-Rays. I'd show you pics of an X-Ray burn (minor) I've received, but they are definitely NSFW.MRIs are quite fun. Very interesting noises, kind of like chiptunes but more repetitive.

author: poorchava
author_rank: Super Contributor
timestamp: April 09, 2013, 08:16:08 am
content: QuoteThis brings some very security-aware application to mind. Very serious tamper-proofing measures were taken as i see. Some kind of banking/other money handling equipment?

author: amyk
author_rank: Super Contributor
timestamp: April 09, 2013, 08:44:52 am
content: Quote from: poorchava on April 09, 2013, 08:16:08 amMy guess is high-end telecommunications; banking equipment would probably have potting too...

author: TerraHertz
author_rank: Super Contributor
timestamp: April 09, 2013, 03:03:42 pm
content: Quote from: amyk on April 09, 2013, 08:44:52 amI'm guessing military communications.There's a glaring lack of photos of the board.Let's hope it's something to do with drone C&C, and he succeeds in cracking it.Here's the board another member & I are currently reversing:

author: lgbeno
author_rank: Frequent Contributor
timestamp: April 12, 2013, 05:31:10 pm
content: Quote from: BravoV on April 09, 2013, 12:21:50 amYes.Sorry but what I mean is that you cannot image a pcb with an MRI. In medicine it is used to image soft tissue that is water/organic based. There isn't much water or organic matter in pcbs.Also there is a good chance that your board contains ferrous metals so that would be dangerous near a 1.5 tesla magnet as it would be strongly attracted to the magnet.A typical MRI also costs $5000 to $10000.X-ray on the other hand can image dense structures which attenuate X-rays. You may be a little confused with ct (computed tomography). Which looks like a mr machine on a diet but that imaging technique is also based on x-rays.You're right that excessive X-ray dose can cause burns and cancer however a simple chest X-ray or Mammography (also X-rays!) is about equivalent to the dose that you would receive on a 8-12 hour flight. Ct is substantially higher dose... I personally would be very conscious of only getting a ct if it is absolutely needed.You also need to watch out for dental X-rays.Spent 4 years designing X-ray machines.

author: G7PSK
author_rank: Super Contributor
timestamp: April 12, 2013, 05:54:46 pm
content: I am totally ignorant on this but would some form of ultrasound scan be of any use. As a by I have had seven CT scans over the past four years and I still do not glow in the dark.https://www.eevblog.com/forum/Smileys/default/scared.gif

author: hlavac
author_rank: Frequent Contributor
timestamp: April 12, 2013, 06:38:44 pm
content: I would grind it from the side using regular CNC mill, taking photos with a usb microscope as I do it, then reconstuct from the slices. Much easier to do precisely and you can keep the components on there

author: free_electron
author_rank: Super Contributor
timestamp: April 12, 2013, 07:12:17 pm
content: http://www.scancad.com/products/fab.phpi checked with my sources and he still claims it is an MRI scan , although i am starting to think it may be a CT scan ...MRI is not necessarily water based.

author: lgbeno
author_rank: Frequent Contributor
timestamp: April 12, 2013, 07:50:33 pm
content: Quote from: free_electron on April 12, 2013, 07:12:17 pmI think ct too they are often confused because they are both large rings that can do 3d reconstruction on an image.I could be wrong but my understanding is that the resonance freq is set to place moment on the two hydrogen nuclei in a watter molecule, when the resonance goes away they reflex and release some energy which is then measured. I would think that other molecules could exhibit the same phenomena however they would have to contain hydrogen. I can't think of many pcb components with such molecule structure.You should offer a bet with your sources.Wrt ultrasound, I don't think that it would work because it would be difficult to couple sound into and out of the pcb board and I don't thinks that if you could that you would really capture informations more than one layer deep.I this X-ray is the only non-invasive way how ever I think the milling method would be best. How cool would it be if there was a machine that cut a cross section of a pcb every 2mils and then took a profile image and reconstructed the image that way. This would solve the planiarity issues with the surface grind method. You could get cool info on the magnetically too. I have next seen this done though except (strangely enoug)h with human anatomy.

author: lgbeno
author_rank: Frequent Contributor
timestamp: April 12, 2013, 09:31:01 pm
content: Autocorrect on the iPhone just kills my posts. Sorry about that.

author: TerraHertz
author_rank: Super Contributor
timestamp: April 14, 2013, 12:52:01 am
content: MRI used to be called NMRI (nuclear magnetic resonance imaging) but they dropped the 'Nuclear' since it scared the patients.How MRI works (so far as I understand it. And if someone spots a mistake, please tell me):Hydrogen nuclei consist of a single proton. Protons have an intrinsic 'spin' property, and since they also carry charge (1+) and mass, the spin results in the proton acting like a small magnet, also with characteristics of a gyroscope.When a strong magnetic field is applied to anything containing hydrogen nuclei, the protons in the hydrogen all align their spin axis with the external magnetic field. This has no effect on the chemical bonds and structures of the sample/patient at all.Then a pulse of RF energy is added. It's an EM field, added to a M field, so the field each atom sees varies in direction. The protons try to align to the new direction. Being gyroscopes, they can't just tilt directly, but instead start precessing, ie their axis is rotating about a centerline.Then the applied RF field is removed. The atoms are still precessing. Now they want to align to the restored original field direction. But they have excitation energy (the precessing) that must be dumped first. The precessing decays away by emission of an RF signal. The frequency of that is proportional to the precession rate of the proton, which is proportional to the amount it was excited in the first place, combined with the magnetic field strength.If the magnetic field is a gradient, hydrogen nuclei in different areas will be emitting their precession decay signals at different frequencies. So the signal from a specific area can be extracted.A 3D image of a sample is built up by repeating the process, while varying the magnetic field strength, RF excitation pulses, and frequency filtering of the receiver.Now here's something that should interest everyone.Back in the 1990s I was wondering if there could be some way to build the proverbial 'data storage in a crystal' we often see in SF stories and movies. Something that used a uniform solid media; cheap, easily made, massively high data density (terabytes per cubic cc), permanent (no data loss over centuries, or better yet millennia), no data loss from surface scratches, etc.I wondered if NMRI might be a way to do it. But what was the achievable resolution?Then I happened to read an article in which medical researchers used NMRI to image the internal structures of a single living cell, in real time, without harming the cell. Photos included, showing the detailed internals of a single cell. (Sorry, no link, this was pre-internet.)Oh OK, so data density is not a problem. That means the only obstacle is finding a material which can be 'written' somehow and read using NMRI. But I don't have the knowledge or resources to proceed.Then, in 1999-2000, I came across these articles:8 October 2000 [The Register] Posted: 09/08/1999 at 19:02 GMTUK boffins unveil $35 '2300GB on a PC Card' RAM breakthroughhttp://www.theregister.co.uk/1999/08/09/uk_boffins_unveil_35_2300gb/8 October 2000 [The Register] Posted: 09/08/1999 at 22:45 GMT'2300GB on a PC Card' RAM technology: more detailshttp://www.theregister.co.uk/1999/08/09/2300gb_on_a_pc_card/10 October 2000 [The Register] Posted: 09/10/2000 at 12:47 GMTUK boffins reckon they can cram 10,800GB of data on a PC cardhttp://www.theregister.co.uk/2000/10/09/uk_boffins_reckon_they_can/Summary:* Back in 1999-2000, a working NMRI storage system was developed.* No moving parts, 10TB capacity on a PC card, 3D storage in a cheap, R/W non-volatile media. High transfer rate.* UK researchers from Keele University, led by Professor Ted Williams - who led the development of the nuclear magnetic resonance scanner originally.* Keele and capital management company Cavendish Management Resources (CMR)have formed a JV, Keele High Density, to market and license the technology.* MD of CMR is Mike Downey.* They had a working, commercial prototype. Market release just waiting for various patents to be granted.* Then suddenly, never heard of again. Suppressed?That would have been a massively revolutionary technology. Very applecart overturning. How could governments control the distribution of information, if huge amounts of data can be handed around in tiny lumps of some cheap solid material? Hey, my shirt button contains the Library of Congress, suck on that Big Brother. Also, bye bye copyright enforceability, and all the associated revenue streams. Sayonara hard disk manufacturers.Then around 2012, US government agencies mention they are now permanently archiving ALL Internet traffic.Google 'Stellar Wind'.Using what storage technology? I bet it's not hard disks. Could it be...Anyone over in England, do you feel like looking into what happened to that Keele University project? Is Professor Ted Williams still alive, and what does he have to say about it?Maybe it was all just hot air. Or maybe not. Wouldn't be the first time (or the last) a 'disruptive technology' was suppressed.

author: houdini
author_rank: Regular Contributor
timestamp: April 14, 2013, 02:01:24 am
content: Or they said it was possible then they tried it and it didn't work.

author: TerraHertz
author_rank: Super Contributor
timestamp: April 14, 2013, 02:28:10 am
content: Quote from: houdini on April 14, 2013, 02:01:24 amNo, the articles I linked are pretty specific. Still online, I just checked. Also I have saved original copies, if it comes to that.Keele developed a working system, starting from a jury rigged prototype using hacked commercial CB radio gear (and a storage medium that was a liquid at room temp and had to be refrigerated to a solid - which I'd bet was more or less plain water) and then later an actual working PC card that held 10TB. No mention of refrigeration then so I presume they found a suitable storage material.I did notice from the articles that they were putting a lot of effort into data compression algorithms, which imo is a dumb mistake. Just develop the damned storage hardware and KISS. Let applications worry about cramming, if & when it's needed. Which it generally isn't.It would be interesting to see the patents. Or even the applications. But I wouldn't be surprised if there's no publicly visible record of the patents. Don't know how to search for those myself.

author: houdini
author_rank: Regular Contributor
timestamp: April 14, 2013, 03:32:30 am
content: http://www.ipaustralia.com.au/applicant/keele-high-density-limited/patents/AU2001235869/That is all i could find on the patent. Seems like its just a bunch of over stated values and little working proof.

author: TerraHertz
author_rank: Super Contributor
timestamp: April 14, 2013, 05:38:34 am
content: Hmm. Turns out I *don't* have the earliest article I recall, in which they talked about their first experimental setup, with the radio gear and frozen liquid storage medium. and you're right, the later ones and the only patent I can find (GB2390736A) just talk about some stupid laser disk system. Even if it was pretty high density.And I can't find that article online now.Curious. Why would the guy who supposedly invented NMRI be involved in that?

author: amyk
author_rank: Super Contributor
timestamp: April 14, 2013, 09:06:33 am
content: Records say the company dissolved in 2009. They might've gone into this instead:http://en.wikipedia.org/wiki/Holographic_Versatile_Disc

author: jeremy
author_rank: Super Contributor
timestamp: April 14, 2013, 12:19:29 pm
content: Have done some experimental MRI stuff in the past. I don't think imaging a PCB would be possible, even having a single non-ferrous metal filling can badly distort an image, let alone a big slab of copper.Anyway, where I am radioimaging scientists/engineers get access to a 3T MRI for about $500/hr, and that is internal costing so expect $$$ with profit margin on top. There is also a 7T MRI where I work, but not just anyone gets to use that I thinkFun fact: while it is true that there is no evidence that MRIs cause any harm, I'm told that if you run in circles around a real NMR spectroscopy system (>20T field), it will induce eddy currents inside your body and make you very sick! God forbid how they found that out, 20T fields would literally rip the belt off your pants.offtopic, TerraHertz: good explanation, but you forgot one step. MRIs also use phase encoding to localise in 3 dimensions, seehttp://en.wikipedia.org/wiki/K-space_(MRI)(although MRIs are horrifically complicated, I'd be lying if I said I had more than a rudimentary understanding of them). Also, all MRIs use a gradient field, they just simply wouldn't work without it!