Hack All The Things, Get All The Schematics

When I was growing up, about 4 or 5 years old, I had an unorthodox favourite type of reading material: service manuals for my dad’s audio equipment. This got to the point that I kept asking my parents for more service manuals, and it became a running joke in our family for a bit. Since then, I’ve spent time repairing tech and laptops in particular as a way of earning money, hanging out at a flea market in the tech section, then spending tons of time at our hackerspace. Nowadays, I’m active in online hacker groups, and I have built series of projects closely interlinked with modern-day consumer-facing tech.

Twenty three years later, is it a wonder I have a soft spot in my heart for schematics? You might not realize this if you’re only upcoming in the hardware hacking scene, but device schematics, whichever way you get them, are a goldmine of information you can use to supercharge your projects, whether you’re hacking on the schematic-ed device itself or not. What’s funny is, not every company wants their schematics to be published, but it’s ultimately helpful for the company in question, anyway.

If you think it’s just about repair – it’s that, sure, but there’s also a number of other things you might’ve never imagined you can do. Still, repair is the most popular one.

Repair, Of Course

Asked to pay for a schematic? You can most likely find it elsewhere for free.

It’s an old chestnut that tech marvels of the past used to come bundled with schematics, and that’s no longer the case. Indeed, they are often top secret. For laptops and phones, one part of that is extensive NDAs that cover information on many a chip within them, including schematics. That said, somehow, this hasn’t stopped certain companies like Clevo, who has been seen putting their designs’ schematics right inside the service manual, for example, the P75xZM_ESM.pdf.

Still, schematics are a market; repair shops earn their keep from being able to fix devices, so a PDF is likely to leak one way or another, often it just takes time. For certain laptop manufacturers and series, this doesn’t happen, but most of all it seems to depend on popularity. In a way, schematics being leaked is a decent indicator that a product is popular enough to hit repair shops en masse, creating demand for underpaid workers to bring a loaded microSD card with them on a trip back home from the factory employing them.

I’m aware that companies sometimes can’t publish much, and, it’s still interesting how publishing schematics and other repair documents is not more popular with companies, despite everything it brings. During my call-in laptop repair days, travelling around with a tiny Asus netbook in my toolbox that used to be a makeup suitcase, I can remember one specific phrase I heard often: “yeah, we don’t like %BRAND%, we’ve had our %BRAND% device break and it couldn’t be fixed”.

Companies Who Publish Nevertheless

When it comes to publicly shared schematics, for instance, Framework laptops have adopted a “Raspberry Pi” approach – share schematics that concern external ports, where no NDAs could conceivably be involved, and even publish further specifications about these ports. This has created a vivid hacking and modding ecosystem around Framework, attracting a good amount of people, and this part in particular is something other companies could do as well. I’ve talked aplenty about the Framework ecosystem already, and I mention the schematic involvement there quite a bit, too!

It’s not just about connectors – there’s plenty of places in a laptop where failures are likely to occur, like power management. Intel might scoff at the CPU and Thunderbolt part pinouts being published, but schematics for these aren’t usually involved in a laptop repair anyway, what fails is usually power management, and chances are, just the schematic pages for that could be published without violating an NDA. Raspberry Pi’s schematics used to work in this way; sadly, RPF has given up on publishing Linux-powered Pi schematics due to being stuck in a perfectionism loop – the Pi 5 schematics are nowhere to be seen, and the USB-C-fixed Pi 4 schematics aren’t available either.

Pine64 is a strange case – their products are not open-source, in large part due to their operation’s scale landing them in a cloning-happy environment. Still, they publish a ton of the information that you might want. Pine64 publishes schematics for their products, and is forthcoming with things like – for instance, ever broke a barrel jack socket on your Pinecil? It’s a rare fault, but in case you somehow have, they stock replacement sockets. Of course, Pinecil schematics are available too, in full, same goes for PinePhone and most of their other products.

I was particularly active in the Pinecil community of the Pine64 discord, and thanks to schematics being accessible in a searchable way, we could help people fix their Pinecils on a community basis, across timezones, often quicker than the tech support could give them a response. In fact, because of the conversations happening in an official Pine64 community, Pine64 tech support could read the conversations in our channel, and avoid repeating many of the debugging steps with the Pinecil owner in question. It really helped that, everything they had to do over email, we could do over real-time chat! Schematics were a crucial part of that, from tracing what could it be that’d die from a reverse polarity what was shorting out the 3.3 V regulator, to the part numbers.

A good few failures were relatively common, and a few community members across different continents, including me, stocked up on some of the commonly involved parts and mailed them out to people in flat envelopes. Compared to the Pinecil sales numbers, the number of failures that we handled was pretty low, but we did help a good few people; generally, people were quite happy about fixing something they own, as opposed to getting a new iron and putting the broken one into a cupboard drawer!

here’s a trace you can cut to protect your old Pinecil from FUSB failure, and gain 24V support as a side effect

It wasn’t just replacing components – together, we narrowed down a particularly common fault that would kill Pinecils or at least make their USB-C PD power input inoperable, and figured out a fix that, in the end, involved simply cutting a trace. The gist is, a pin of a specific IC on the Pinecil was connected directly to the power input rail, this pin specifically was sensitive to overvoltage, killing the chip in a way that sometimes would even pull down the entire 3.3 V rail. What’s interesting, it didn’t have to be connected to that rail at all! The community designed a fix, people have applied it for both failure immunity and also being able to use 24 V bricks. Later on, Pine64 applied the fix to a new batch of the Pinecil hardware, which is now immune to this fault.

Before the ability to just cut the trace was figured out by [Thanos the tank engine] and others, I managed to design an addon board that’d down-regulate the voltage with a Zener diode, and even published the files for it. After all, you can design a whole lot if schematics are available!

Build All The Cool Stuff

Hackers have long used schematics to design things like addons – physical board attributes, you can redesign with calipers in hand, but schematics capture everything else. All those consoles put into tiny formfactors, made possible because of the motherboard being cut down? Schematics were likely involved in one way or another.

having schematics how [Wificable] could figure out there are two separate PCIe links on this connector, and make a riser exposing them both at the same time
Friends of mine have done the same kind of schematic-inspired design, on a number of occasions – in particular, [Wificable] has designed an MXM reuse adapter and a good few MXM cards only thanks to available schematics, and her TinyRiser, an adapter that pulls extra PCIe from a particular lineup of Lenovo Tiny computers, was only possible because we could get find the relevant PDF in a Telegram group.

Got a technical question the manufacturer doesn’t expand on? A schematic is a reliable way to check.

It’s not just addons, it’s also finding information you can’t find otherwise. Wondering what your laptop’s USB-C port does, whether it supports DisplayPort, or charging input? The manufacturer’s website might not be helpful at all, but the schematics show it all instantly, on the page with the block diagram. I’ve seen a product being developed, an ExpressCard slot adapter housing an SSD, that researched laptop schematics to figure out 3.3 V current limits on the ExpressCard slot and how they were implemented in different laptops.

Tapping into the iPhone battery market to get a reliable source of slim batteries for your project? Use the schematics to find the battery connector pinout – and the connector part number. Remember the M.2 card with a 1:2 PCIe switch, that I’ve shown you the design process of? That one was only possible because of a laptop schematic we found featuring the ASM1182e chip. Schematics often contain part numbers, and these are super helpful – you could consult one of the connector bibles, or you could simply copy the part number for a connector out of a schematic PDF and get the exact part number necessary.

Remember that Sony Vaio P motherboard rebuild project I’ve started? I’ve just recently received the v1 PCBs of a motherboard I designed, now they’re waiting to be assembled, and I couldn’t have had done this without all the connector pinout information I found in the schematic. In particular, it might be that this motherboard replacement will be impossible to adapt to the second revision of these Vaios, since, as far as I’ve seen, that revision’s schematics haven’t leaked. Well, either way, expect an article about the new motherboard soon!

There’s way, way more you can learn from schematics as you go. One of my current projects requires learning a fair bit from the PinePhone schematic and specifically its LTE modem that boasts open firmware, as part of uncovering yet another series-worthy topic; naturally, you will hear about that one soon. Schematics keep a treasure trove of hacker-friendly information in them, and information deserves to be free.

29 thoughts on “Hack All The Things, Get All The Schematics

  1. Here here, absolutly!!

    > Schematics keep a treasure trove of hacker-friendly information in them, and information deserves to be free.

    As a society we can improve best by working together. Freedom of information is crucial if you want this done efficiently.

    Inventing the same thing 5 times si sich a waste of resources.

    But the same can be said for datasheets! a ton can be learned feom them and makes it possible to decide to use a part or go with the competitors. Hiding these things makes no sense at all.

    Free all information!

    P.S. trae -> trace

        1. I draw my own schematics with Kicad so they are legible. It helps me focus on what I am doing, and when I build the thing I have clear documentation (after fixing any errata, of course).

          If I then need to make a PCB I have a head start.

          BTW why does this poxy new commenting system fail to save my details? It works sometimes, but I have to re-type everything every so often.

  2. I used to read data books. Like National Semi linear (volumns I & II) etc…. loved ’em all. Any if the “Cookbooks” out there etc…. my head is so full of useless/obsolete info now I can’t hardly add any new stuff.

    1. I still remember the first time our TI rep stopped by our office with hardcover TTL data books. I still have mine and yes those navy blue cover National databook were a learning experience. Any Bob Pease devotees out there ?

      1. for me it was my Dad horde of service manual for Terex dumpers,P&H cranes and Champion graders then i moved to UK and found RS catalogs, i would spend hours over them thinking of design uses for the parts i found interesting today.

  3. I usually grab old schematics books at flea markets just in case I need them, including old TVs ones. Although I certainly do not engage in repairing old CRT TVs, who knows what information could be found there the day I need it; like that obscure SAW filter or video amplifier IC found NOS somewhere that I could reuse in a receiver IF, other RF chips, delay lines, etc.
    Also, some years ago tuner modules taken from old TVs were used to build VHF/UHF receivers before SDR offered a simpler alternative. Although using both (TV tuner as front end, SDR as IF and all mode demodulator) could make for an interesting project.

    1. I always enjoyed SAMS Photosacts … you not.only got the schematic but test procedures… waveforms.. and theory of operation narratives. Some public libraries (like Austin TX) had them. And you didnt have to sign an NDA to borrow them !

      1. It would be great if access to schematics were part of the right to repair movement. Nothing frustrates me more then the threat of having to replace a $500 appliance control board just because a 75 cent capacitor is bad.

    2. IIRC, there were magazine articles about TV tuners that used varactor diodes being repurposed for spectrum analyzers. But varactor tuners were late in the game.

    1. Hell, my first computer (a Franklin Ace 1000 — a not super popular Apple ][e clone) had its conplete motherboard schematic as an appendix to the user manual which made it possible to wire a couple microswitches to stand in for the “Open Apple” and “Closed Apple” modifier keys which they’d been forced to remove due to a lawsuit.

      I figured this out and made the simple bodge wire and super glue mod which then made it possible to run UCSD p-System and UCSD Pascal which were literally unusable without those modifier keys.

      I wonder if Apple made some back room deal with software vendors because there were *lots* of software packages that reauired those modifiers which could just as well have used CRTL and SHIFT for hotkey bindings, and their ubiquity made life hard of users of clones…

  4. I tried finding schematics for solar power inverters. None.
    When I started in electronics in the 60′ s all the companies I dealt with gave them out.
    Now we literally have to throw away things like inverters because of modern attitudes.
    Another thing I tried was convincing BMW to publish details of their engine management software for motorcycles. The idea being that enthusiastic hackers could make improvements that BMW could use themselves to save money and improve their products. Not interested.

    1. Vehicle manufacturers hide behind safety & emissions as an excuse, I’m hoping as EV’s gain popularity they will get more pressure to publish data since they can’t argue people are going to hack their EV to roll coal…

  5. Over the years I’ve gone from device included papers and going across town to the uni-lib for Sams’ to nothing at all. I’ve never seen a schematic for any telephone device, VCR, digital tuned radio car or home stereo, computer accessory yet the host.
    I service organs where the oldest had a binder or book full to the latest with just a few pages but half of what I fixed was without any aid. Clean off, sharp eye exam, know what is most likely stuff to fail and re-solder. Connectors and switches, air gun and soldering gun. Most of the surface mount stuff is still working at the board level it’s the nitty gritty dirt ban time.

  6. I remember a time when I was repairing a big automotive class D power amplifier and was unable to find the schematics, so I did send some emails to the manufacturer, with pictures of the device, a description of the fault and all the checks and steps I had done to try to repair it, after a while I got like 3 replies with something like oh well sorry we cannot provide such details, contact your customer services, and then I got another one from one that was like: After reading your email, I have to tell you I cannot provide the pdf files that are in the link I’m attaching. Do not share this mail. So yeah the amp was soon kicking again and I never shared the files,I guess they are still in my inbox.

  7. I am addicted to the Lenovo and Clevo schematics. Did you know you can buy a sub $300 laptop, put a sub $70 10th gen 8 core unlocked processor in it and a ~$300 RTX3080 165w MXM? And then sell off the original 8700K and 1070 MXM and pick up an air and watercooled heatsink? Clevo P775 and P750TM are amazing. Although I do have my eye on a Lenovo 16″ OLED with swappable MXM if I get a grant for schooling computer. (12th gen was such a leap forward, I’ve also heard rumors Lenovo will use the new surface mount ram package in an upcoming laptop).

    I’m bummed I didn’t know about that spare PCIe port on the Tiny5, one of my first Tiny5 was the P330 so I had the second M.2 slot (and the Chipset heatsink) standard. I had no idea about the third slot 😂. Shame about the missing 8 lanes from the CPU though. Unless they go to the M.2 for better bandwidth/latency.

    1. Unfortunately the last 8 CPU lanes just aren’t used at all in these Lenovo Tiny boxes, I guess they didn’t think they were needed. It would have been cool to have those extra lanes available, maybe even for more bifurcation potential. Could’ve resulted in a lot more cool riser ideas. The extra x4 link is already pretty cool though.

      1. I’d be happy with them just going to the standard 2x M.2 slots. But obviously this isn’t a “workstation” class product. Who knows, maybe the wiring or BIOS would have been a headache.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.