Incredible Soldering In The Name Of Hardware Support

September 5, 2020 by Tom Nardi 31 Comments

If you’re developing a performant IP-KVM based on the Raspberry Pi, an HDMI capture device that plugs into the board’s CSI port would certainly be pretty high on your list of dream peripherals. Turns out such devices actually exist, and somewhat surprisingly, are being sold for reasonable prices. Unfortunately the documentation for the chipset they use is a bit lacking, which is a problem if you’re trying to wring as much performance out of them as possible.

As the creator of Pi-KVM, [Maxim Devaev] needed to truly understand how the Toshiba TC358743 chip used in these capture devices worked, so he decided to build his own version from scratch. In the name of expediency, he didn’t have a proper breakout board made and instead decided to hand-solder the tiny BGA chip directly to some parts bin finds. The resulting perfboard capture device is equal parts art and madness, but more importantly, actually works as expected even with 1080p video signals.

Ultimately, the lessons learned during this experiment will lead to a dedicated KVM board that will plug into the Pi’s expansion header and provide all the necessary hardware in one shot. As [Maxim] explains in the Pi-KVM docs, the move to the CSI connected Toshiba TC358743 cuts latency in half compared to using a USB capture device. That said, USB capture devices will remain fully supported for anyone who just needs a quick way to get things working.

This DIY capture card is a perfect example of how the skills demonstrated while working on a project can be just as impressive as the end result. [Maxim] didn’t set out to hand-solder a BGA HDMI capture chip, it was merely one step in the process towards creating something better. Those intermediary achievements are often lost in the rush to document the final project, so we’re always glad when folks take the time to share them.

[Thanks to Eric for the tip.]

High-End Ham Radio Gives Up Its Firmware Secrets

July 14, 2020 by Dan Maloney 46 Comments

Amateur radio operators have always been at the top of their game when they’ve been hacking radios. A ham license gives you permission to open up a radio and modify it, or even to build a radio from scratch. True, as technology has advanced the opportunities for old school radio hacking have diminished, but that doesn’t mean that the new computerized radios aren’t vulnerable to the diligent ham’s tender ministrations.

A case in point: the Kenwood TH-D74A’s firmware has been dumped and partially decoded. A somewhat informal collaboration between [Hash (AG5OW)] and [Travis Goodspeed (KK4VCZ)], the process that started with [Hash]’s teardown of his radio, seen in the video below. The radio, a tri-band handy talkie with capabilities miles beyond even the most complex of the cheap imports and with a price tag to match, had a serial port and JTAG connector. A JTAGulator allowed him to probe some of the secrets, but a full exploration required spending $140 on a spare PCB for the radio and some deft work removing the BGA-packaged Flash ROM and dumping its image to disk.

[Travis] picked up the analysis from there. He found three programs within the image, including the radio’s firmware and a bunch of strings used in the radio’s UI, in both English and Japanese. The work is far from complete, but the foundation is there for further exploration and potential future firmware patches to give the radio a different feature set.

This is a great case study in reverse engineering, and it’s really worth a trip down the rabbit hole to learn more. If you’re looking for a more formal exploration of reverse engineering, you could do a lot worse than HackadayU’s “Reverse Engineering with Ghidra” course, which just wrapping up. Watch for the class videos soon. Continue reading “High-End Ham Radio Gives Up Its Firmware Secrets” →

A Dead Macbook GPU Shouldn’t Stop You, With This BGA Soldering Hack

June 28, 2020 by Jenny List 42 Comments

On some 2011 Macbook Pro models, there is a tendency for the Radeon GPU to fail. This should mean game over for the computer, but surprisingly salvation is offered by its having not one but two GPUs on board. The Intel processor also has a GPU, and Apple use a pile of logic in an FPGA to switch at will between them. The community have produced fresh FPGA code to revive a dead Mac on its Intel GPU, but at the expense of losing brightness control. [Ayilm1] has brought back the brightness with a clever BGA reworking hack that gains access to a brightness control line present on the Intel BD82HM65 Platform Controller Hub chip but not used in the Macbook.

We’re used to impressive soldering work here at Hackaday, and we’ve seen our share of wiring direct to the balls on an upturned BGA chip. This is a similar idea but at another level, as a section of the top insulation on an in-place BGA is removed to expose the microvia above the ball carrying the required signal. A tiny wire is soldered to the exposed pad and taken to a piece of copper tape stuck down to provide mechanical strength, and a piece of enameled copper wire is run from that to the other side of the PCB where lies its destination. It comes with FPGA code to take advantage of it, but even for non-Macbook owners, it’s an extremely impressive piece of work. It’s not the first fine-soldering Macbook fix we’ve seen, either.

Thanks [lightpink784] for the tip.

How To Design A BGA Breakout Module

November 16, 2019 by Lewin Day 11 Comments

Surface mount devices can take some adjusting to for hackers primarily used to working with through-hole components. Despite this, the lure of the hottest new parts has enticed even the most reticent to learn to work with the technology. Of course, time rolls on and BGA parts bring further difficulties. [Nate] from SparkFun worked on the development of the RedBoard Artemis, and broke down the challenges involved.

The RedBoard Artemis is an Arduino-compatible devboard built around the Ambiq Apollo3 chip. In addition to packing Bluetooth and 1 MB of Flash, it’s also capable of running TensorFlow models and using tiny amounts of power. The chip comes in an 81-Ball Grid Array at 0.5mm pitch, which meant SparkFun’s usual PCB fabrication methods weren’t going to cut it.

An initial run of prototype boards was run using 4 layers, blind and buried vias, and other fancy tricks to break out all the necessary signals. While this worked well, it was expensive and inefficient. The only part of the board that needed such fabrication was around the chip itself; the rest of the board could be produced with cheaper 2-layer methods. To improve this for mass production, instead, an SMD module was created to house the Apollo3, which could then be dropped into new designs on cheaper boards as necessary.

[Nate] does a great job of explaining the engineering involved, as well as sharing useful tips for others going down a similar path. So far, this is just part 1, with future posts promising to cover the RF shield design and FCC certification process. [Nate] has always been keen to share his wisdom, and we can’t wait to see what comes next!

Hackaday Podcast 026: Tamper-Proof Electronics, Selfie Drones, Rocket Fuel, Wire Benders, And Wizard-Level Soldering

July 12, 2019 by Mike Szczys 1 Comment

Hackaday Editors Mike Szczys and Elliot Williams are back after last week’s holiday break to track down all of the hacks you missed. There are some doozies; a selfie-drone controlled by your body position, a Theremin that sings better than you can, how about a BGA hand-soldering project whose creator can’t even believe he pulled it off. Kristina wrote a spectacular article on the life and career of Mary Sherman Morgan, and Tom tears down a payment terminal he picked up in an abandoned Toys R Us, plus much more!

Take a look at the links below if you want to follow along, and as always tell us what you think about this episode in the comments!

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (60 MB or so.)

Continue reading “Hackaday Podcast 026: Tamper-Proof Electronics, Selfie Drones, Rocket Fuel, Wire Benders, And Wizard-Level Soldering” →

BGA Hand Soldering Uses Tombstone Resistor Technique, Demands Surgical Precision

July 8, 2019 by Jenny List 19 Comments

Most Hackaday readers will be a pretty dab hand with a soldering iron. We can assemble surface-mount boards, SOICs and TSSOPs are a doddle, 0402s we take in our stride, and we laugh in the face of 0201s. But a Twitter thread from [Greg Davill] will probably leave all but the most hardcore proponents of the art floundering, as he hand-wires a tiny FPGA in a BGA package to the back of a miniature dot-matrix LED display module.

Resistors soldered on-end, awaiting wires to connect to the BGA microcontroller

As far as we can see the module must once have had its own microcontroller which has been removed. We’d guess it was under an epoxy blob but can’t be sure, meanwhile its pads are left exposed. The Lattice LP1k49 fits neatly into the space, but a web of tiny wires are required to connect it to those pads. First, [Greg] populates the pads with a set of “tombstoned” tiny (we’re guessing 0R) resistors, then wires them to the pads with 30μm wire. He describes a moment of confusion as he attempts to tin a stray hair, which burns rather than accepting the solder.

The result is a working display with a new brain, which surprises even him. We’ve seen more than one BGA wiring over the years, but rarely anything at this scale.

It’s worth mentioning that [Greg] was behind the FLIR frame grabber that was a runner-up in last year’s Hackaday Prize. We admire the photos he’s able to get of all of his projects and aspire to reach this level with our own. Take this as inspiration and then check out the Hackaday contest for Beautiful Hardware images happening right now.

Thanks [Sophi] for the tip.

Flip Chips And Sunken Ships: Packaging Trick For Faster, Smaller Semiconductors

April 11, 2019 by Ted Yapo 20 Comments

You may have heard the phrase “flip-chip” before: it’s a broad term referring to several integrated circuit packaging methods, the common thread being that the semiconductor die is flipped upside down so the active surface is closest to the PCB. As opposed to the more traditional method in which the IC is face-up and connected to the packaging with bond wires, this allows for ultimate packaging efficiency and impressive performance gains. We hear a lot about advances in the integrated circuits themselves, but the packages that carry them and the issues they solve — and sometimes create — get less exposure.

Cutaway view of traditional wire-bond BGA package. Image CC-BY-SA 4.0 @TubeTimeUS

Let’s have a look at why semiconductor manufacturers decided to turn things on their head, and see how radioactive solder and ancient Roman shipwrecks fit in.

Continue reading “Flip Chips And Sunken Ships: Packaging Trick For Faster, Smaller Semiconductors” →