Skip to content
Hallway
0:00 / 0:00

#reverseengineering#fpga#jtag

FPGA Dev Live Stream: Reverse-engineering an Undocumented FPGA Board

Alex Forencich

1.9K subscribers • 2 videos on Hallway

YouTube
  • Recommended by 2 people: 2 in engineering communities.
  • Presented by Alex Forencich, creator of Corundum
  • Linked in the descriptionalexforencich/pin-uart

Advanced. Deep dive for people who know the field.

3.1K views4 years ago2 recommendations

HardwareSecurityReverse engineeringFPGAs and digital designElectronics

Alex Forencich demonstrates how to reverse-engineer pin connections on an undocumented FPGA board using a multimeter, oscilloscope, and JTAG.

FPGA development live stream: reverse-engineering an undocumented FPGA board. In this stream, I will be looking at a few methods for determining many of the connections between an FPGA and various peripheral components on a board, without access to board-level documentation. Tools used will include a multimeter, oscilloscope, and the FPGA itself. We'll also take a look at a couple of other FPGA boards for reference, including a new Intel Agilex dev board that arrived recently. The board featured in this video is a DNPCIe_40G_KU_LL_2QSFP. Web page for a related board (only 1 QSFP) on the wayback machine: web.archive.org/web/20141011214810/http://www.dinigroup.com/… Update: an updated version of the pin UART code is here: github.com/alexforencich/pin-uart . This uses TCL instead of python so that it can run within Vivado and directly extract all of the GPIO pins, without requiring a separate pinout file. If you like what I do, please consider supporting me on Patreon: patreon.com/alexforencich

Why it's here

2 people recommend this

What people say. Recommended as an excellent guide on how to reverse-engineer FPGA board pinouts.

u/tencherry01in r/FPGA • Recommends

On “Trying out high end fpga cards from Xilinx or Intel”

…now, I would suggest you look up ebay/aliexpress or maybe an old FPGA miner card. You may get lucky and find a card where the vendor may provide a pinslist for you (or can make available to you if you ask nicely). If not, you may have to reverse engineer the pins list. Here is a good YT video showing you how you would go about doing such a thing: link to this video but it may be outside of your comfort level. You can also try to google for the board to see if someone else already published the pinslist for you. A lot of time, you can get pretty lucky and use a related VCUxxx devkit to guess what and how the pins will be used (esp for these pcie alveo card which are mostly just SFP/QSFP+PCIe+FPGA w/ so…
7View on Reddit

u/proto17in r/FPGA • Recommends

On “Convey Wolverine”

I was looking at that too. One thing that's nice about the board is that there don't appear to be blind vias under the FPGAs, so you could probably pin the whole thing out with a multimeter. Or, if you have the required equipment, use the technique outlined here from /u/alexforencich which will be *much faster*. All you need to know for that is where the JTAG pins are. I think you can also get away with using the onboard configuration clock. Can't recall if he uses that clock or finds one on the board.
2View on Reddit