Hardware Analysis Series – Part 2: Component identification and information gathering

By Kike Gandia · Hardware & OT · 17 min read

Illustration of a main chip under an orange magnifying glass, connected by traces to two smaller components

Analyzing embedded and industrial hardware calls for a meticulous, systematic approach that begins with a complete understanding of the printed circuit board before any intervention takes place. This methodology not only identifies the components and how they interact, but also reveals potential attack vectors that a less rigorous approach could miss. Hardware security demands a combination of close observation, deep technical knowledge and precise documentation. The results of this preliminary analysis determine how effective every later test will be, which makes this initial phase the cornerstone of any security audit of electronic devices.

Phase 1 — Thorough visual inspection
Look at the board before touching it: silkscreen, manufacturer markings and the circuit's functional zones.
Phase 2 — Component identification
Recognize the essential chips, understand their packages and locate the critical interfaces and connectors.
Phase 3 — Trace and architecture analysis
Trace signals with a multimeter and logic analyzer, and map voltage levels to reconstruct the logic.
Phase 4 — Rigorous documentation
Technical photography, schematics and organized findings: what is not documented cannot be audited twice.
Phase 5 — Intrusion vectors
With the map in hand, identify the way in: memory chips, debug interfaces and protocols.

The full methodology of this installment, from the magnifying glass to the attack vector.

Thorough visual inspection

Visual inspection fundamentals

Visual inspection is the fundamental first step in any hardware analysis, providing an initial understanding of the device's architecture and components. This non-invasive technique reveals crucial information about layout, interconnections and possible points of interest for later analysis.

According to experts, the ability to correctly interpret the visual cues on a PCB can significantly reduce the time needed to identify access points and potential vulnerabilities. A meticulous visual inspection reveals details that more sophisticated but less intuitive techniques may miss, laying a solid foundation for the entire analysis process9.

Observation and analysis techniques

Digital and stereo microscopes have revolutionized PCB inspection, offering capabilities that go far beyond a simple magnifying glass. They make it easy to maneuver the PCB under the objective lens, simplify the use of different lighting types to bring out details, and let you switch quickly from an overview to a close-up of specific areas of interest.

FusionOptics technology provides three-dimensional perception of the PCB, combining high resolution with greater depth of field, which is particularly useful for analyzing components with complex geometries. The recommended practical magnification range for PCB inspection is between 5x and 30x, allowing both an overview of an area at lower magnification and a view of fine details at higher magnification.

Reading silkscreen and markings

Printed circuit boards carry valuable information encoded in their silkscreen, labels and markings, which serve as a map for the experienced analyst. Correctly identifying these markings (U for integrated circuits, R for resistors, C for capacitors, L for inductors) gives immediate insight into each component's function. Understanding the labeling scheme not only speeds up component identification, but also reveals the underlying design philosophy and any standards the manufacturer may have followed. Silkscreen can indicate specific functional zones, such as power, communications or processing areas, giving an overview of the system architecture before moving on to more detailed analysis.

Detecting functional zones

The grouping of components on a PCB is rarely random; on the contrary, it usually follows a functional logic the analyst must learn to read. Manufacturers tend to group functionally related components, creating zones dedicated to specific functions such as processing, memory, communications or power. Correctly identifying these functional zones makes it possible to understand the overall system architecture and quickly pinpoint areas of interest for later analysis. A clear example is the microcontroller grouped with its oscillator and associated memory, or the cluster of filtering components near communication connectors. This spatial organization provides valuable clues about how information flows within the system and about possible access points for deeper security analysis.

Detailed component identification

Recognizing the essential components

Identifying the components on a printed circuit board is a fundamental skill for any hardware analysis, especially in a security context. Each component, such as resistors, capacitors, diodes and transistors, has a specific function within the circuit that contributes to the overall operation of the device.

The most critical components to identify include microcontrollers (MCUs) or systems on chip (SoCs), since they are usually the brains of the device and control all its operations. Memory such as EEPROM, SPI flash, NAND or eMMC holds critical data such as firmware and configuration, which makes it a primary target for security analysis. Communication components such as Ethernet transceivers, Wi-Fi/Bluetooth modules or serial interfaces must also be identified precisely, since they represent potential entry vectors for an attacker.

Understanding packages and packaging

Electronic components come in a variety of package formats that must be recognized in order to identify them correctly. Common packages include SOP (Small Outline Package), DIP (Dual In-line Package), QFN (Quad Flat No-leads), BGA (Ball Grid Array) and TQFP (Thin Quad Flat Package), each with distinctive features that make them easy to recognize visually.

BGAs, for example, pose a particular challenge in security analysis because their connections are hidden underneath the chip, requiring special techniques such as X-ray inspection for a full analysis. Understanding these formats helps you quickly identify key components and choose the right tools and techniques to analyze them, especially when looking for access points for firmware extraction or debugging.

Advanced identification methods

To identify components precisely, especially those with unclear or erased markings, there are advanced methods that go beyond simple visual inspection. Multimeters are essential tools for testing components, letting you check resistance, continuity and the behavior of diodes and transistors. Datasheets are invaluable resources containing detailed information on component specifications, pinouts and functionality, helping to determine each part's exact role in the circuit. Online tools such as Octopart let you search for components by part number, giving access to full technical information even when you only have partial data. For more complex components such as microcontrollers or memory chips, identification may require combining these techniques with electrical signal analysis to confirm their exact function within the system.

Identifying critical interfaces and connectors

Connectors and headers on a PCB are critical points of interest in any security analysis, since they can provide direct access to debug or programming interfaces. The most sought-after interfaces include UART (Universal Asynchronous Receiver-Transmitter), JTAG (Joint Test Action Group), SPI (Serial Peripheral Interface) and I2C (Inter-Integrated Circuit). JTAG is particularly valuable for security analysis, since it allows you to extract firmware, inspect registers, read and write memory, and access I/O devices connected to the processor.

Correctly identifying these interfaces requires both visual inspection (looking for characteristic pin patterns) and electrical verification with a multimeter or logic analyzer. Some manufacturers try to hide these interfaces by removing labels, reconfiguring pins or even cutting traces, so it takes experience and persistence to locate them correctly.

Trace analysis and logical architecture

Signal tracing principles

Analyzing the electrical paths on a PCB shows how the components interact and how information flows through the system. The traces on a PCB are copper paths that connect components, allowing electrical signals to travel between them. The quality and design of these traces directly affect the device's performance, reliability and signal integrity.

For effective analysis, it is vital to understand that traces should connect to the center of pads and vias to ensure reliable electrical and solder performance. Trace orientation is also crucial; experts recommend using 135-degree angles when traces must be routed at arbitrary angles, since improper angling can cause manufacturing complications and affect signal integrity.

Using the multimeter for continuity analysis

The multimeter is a fundamental tool for tracing and verifying connections on a PCB during security analysis. Continuity tests are used to make sure there are no breaks in the electrical paths, confirming that the connections between components and traces are intact. To run the test, set the multimeter to continuity mode (usually indicated by a sound-wave symbol), place the black probe at one end of the circuit and the red probe at the other; the multimeter will beep if there is continuity. This technique is particularly useful for identifying the paths that connect critical components such as microcontrollers, memory and data buses, making it possible to map the system's logical architecture without more complex tools. Continuity tests can also reveal intentional design modifications, such as cut or rerouted traces, that may point to anti-analysis measures implemented by the manufacturer.

Applying logic analyzers

Logic analyzers are essential devices for characterizing and visualizing digital signals over time, providing deep insight into the electrical behavior of components. They capture multiple data channels simultaneously, making it possible to observe how different components interact and to verify communication protocols such as UART, SPI, I2C or JTAG.

Modern analyzers offer sample rates of up to 500 MS/s and digital bandwidths of 100 MHz, enough to capture most communications in embedded systems. Automatic protocol decoding makes logic analyzers indispensable for deciphering communications between components, identifying the protocols in use and detecting possible weaknesses in their implementation that could be exploited in an attack.

Mapping voltage levels and signals

Correctly mapping the operating voltage levels across different parts of a PCB is crucial for any security analysis, since it determines which tools and techniques are appropriate for interacting with the system. Modern devices may run at various voltage levels (1.8V, 3.3V, 5V) in different sections of the circuit, and applying the wrong voltage during analysis can permanently damage components. Voltage is measured by setting the multimeter to the appropriate DC voltage range and checking key points such as power supplies and signal paths. Beyond voltage levels, it is important to identify the types of signals present (digital, analog, PWM) in order to select the right analysis tools. This information is particularly relevant when planning how to connect external tools such as memory programmers, logic analyzers or JTAG interfaces for firmware extraction and analysis.

Rigorous, structured documentation

Why technical documentation matters

Thorough documentation is a critical component of hardware security analysis, since it ensures that the information gathered is accessible, shareable and verifiable. A PCB fabrication drawing serves as a blueprint for the board and provides detailed information about its specifications and unique characteristics4. Proper documentation answers many of the questions that may come up during analysis and makes findings easier to verify, avoiding wasted time and errors. A well-structured record also makes it possible to resume the analysis after interruptions or hand it over to other team members without losing information. In a security context, meticulous documentation also provides solid forensic evidence, which can be crucial in audits or incident investigations.

Photographic documentation techniques

High-quality technical photography is the foundation of good documentation in PCB security analysis. Photos should capture both sides of the board in enough detail to identify components and traces, using proper lighting to avoid reflections and shadows that could hide important details.

Lighting is particularly critical; a ring light with diffusers or polarizers can eliminate glare from the PCB's reflective surfaces, revealing details that would otherwise be invisible. For small components or faint markings, digital microscopes are recommended, since they capture images directly in digital form with great detail and precision. These photos should be organized systematically, with descriptive file names and metadata recording the date, time and capture conditions, building a complete visual database of the device under analysis.

Creating schematics and technical documentation

Turning visual observations and electrical measurements into formal technical schematics is an essential step in documenting a PCB analysis. Preliminary basic schematics created in tools such as KiCad or Altium Designer provide a clear visual representation of the connections between components, making later analysis easier. These schematics should be supplemented with detailed technical notes covering component specifications, measured voltage levels and behavior observed during testing. Technical documentation should follow recommended practices such as using standard formats and symbols, including all relevant details and specifications, and carefully checking for errors and inconsistencies. Well-structured documentation not only supports the current analysis but also serves as a valuable reference for future analyses of similar devices.

Organizing findings and results

Organizing findings systematically is as important as documenting them in the first place, since it allows quick access to specific information and helps establish relationships between different aspects of the analysis. Results should be cataloged under logical categories such as "identified components", "debug interfaces", "communication protocols" and "potential attack vectors", making them easier to consult later. For each critical component identified, keep a record that includes its function, specifications, relevant datasheets and any notable observations made during the analysis. Potential access points or vulnerabilities should be documented in particular detail, including photos, measurements taken and possible exploitation methods. This methodical organization makes it possible to build a holistic view of the device and its vulnerabilities, making it easier to plan specific tests in later phases of the analysis.

Identifying potential intrusion vectors

01 Memory access: SPI flash, EEPROM, NAND or eMMC are the primary vector: they hold the firmware, and with it the device's keys, paths and logic.
02 Debug interfaces: UART, JTAG, SPI and I2C can provide privileged access to the system if they were left enabled in production.
03 Communication protocols: Poor implementations (badly isolated signals, missing validation) turn the bus into an attack vector.
04 Advanced techniques: Side channels that leak through power consumption, emissions or timing, and fault injection via voltage or clock glitching, electromagnetic pulses or heat.

The four intrusion vectors to look for on the board.

Memory access for firmware extraction

Storage memory such as SPI flash, EEPROM, NAND or eMMC represents a primary intrusion vector in hardware security audits, since it holds the device's firmware and critical data. There are multiple techniques for extracting firmware from these components, ranging from highly invasive to non-destructive. A direct technique is to identify the memory chip, physically remove it from the board, solder it onto another compatible board and extract its contents; however, this method is risky and can permanently damage the component. Less invasive alternatives include connecting to the memory pins in-circuit using dedicated clips (such as SOIC clips) or test probes, and using universal programmers such as the CH341A or TL866II to communicate with the chip and dump its contents. In some cases, the memory contents can be accessed through the device's own operating system, if you manage to get a shell with the right privileges.

Debug interfaces and consoles

Debug interfaces such as UART, JTAG, SPI and I2C provide powerful intrusion vectors that can allow privileged access to the system. UART (Universal Asynchronous Receiver-Transmitter) is particularly valuable, since many devices expose debug consoles over this interface that can provide access to system shells or bootloaders. Identifying UART pins usually requires multimeter analysis to locate the transmit (TX), receive (RX) and ground (GND) lines, followed by analysis with an oscilloscope or logic analyzer to determine the baud rate. JTAG offers even more powerful capabilities, allowing full control over firmware execution and inspection of registers and memory, plus access to I/O devices connected to the processor. Although some manufacturers try to hide or disable these interfaces with techniques such as cutting traces or reconfiguring pins, a meticulous analysis can reveal their presence and make it possible to re-enable them.

Vulnerabilities in communication protocols

The communication protocols implemented in embedded and industrial devices may contain vulnerabilities that provide significant intrusion vectors. Unencrypted or poorly authenticated communications are particularly vulnerable to interception, tampering or replay attacks. Analyzing these protocols requires capturing the traffic with logic analyzers or dedicated sniffers, and understanding both the message format and the communication sequences. Common protocols such as I2C, SPI and UART have specific characteristics that must be taken into account during PCB layout and design to ensure signal integrity and reduce susceptibility to interference or unauthorized eavesdropping.

Understanding these design considerations can reveal implementation weaknesses that could be exploited as attack vectors, such as poorly terminated signals, a lack of proper isolation or needlessly exposed communication lines.

Advanced hardware hacking techniques

Hardware hacking combines knowledge of electronics, inter-component communications, operating systems and software reverse engineering to analyze and potentially compromise electronic devices.

Advanced techniques include side-channel analysis, which exploits information leaking through power consumption, electromagnetic emissions or processing time to infer information about cryptographic operations or other sensitive processes.

Fault injection attacks use techniques such as voltage or clock glitching, electromagnetic pulses or thermal manipulation to induce anomalous behavior that can result in security protections being bypassed. A silicon die attack is an extremely advanced technique that physically modifies a chip's silicon, and can re-enable disabled interfaces such as JTAG by directly manipulating the chip's internal fuses. These techniques require specialized equipment and deep expertise, but they can defeat security measures considered impenetrable by conventional methods.

Recommended advanced tools

See Visual inspection and analysis: Digital and stereo microscopes, and automated optical inspection (AOI) systems with high-resolution cameras to capture the board from different angles.
Measure Electrical instrumentation: Digital multimeters for continuity, resistance and voltage, and in-circuit test (ICT) testers to verify full circuit functionality.
Analyze Specialized software: PulseView or the Saleae Logic suite to visualize and decode the protocols captured with the logic analyzer.
Dump Firmware extraction: Programmers and adapters to access, dump and examine the contents of the device's memory.

The four families of tools a hardware audit requires.

Equipment for visual inspection and analysis

Quality visual inspection equipment is essential for effective PCB analysis, starting with digital and stereo microscopes that offer key capabilities for examining components and connections. Stereo microscopes with FusionOptics technology provide a three-dimensional view with high resolution and great depth of field, making it easier to inspect and handle PCBs. Digital microscopes offer additional advantages such as direct image capture, precise dimensional measurement and advanced lighting options to reveal hidden details.

For automated inspection, automated optical inspection (AOI) systems use high-resolution cameras to capture images from different angles and under different lighting conditions, detecting defects such as scratches, stains, open circuits, short circuits and misplaced or missing components. For special cases where hidden connections under BGA or CSP components need to be analyzed, automated X-ray inspection (AXI) systems make it possible to see through the packages and examine the solder joints and internal connections.

Instrumentation for electrical analysis

Precise electrical analysis instrumentation is indispensable for evaluating the behavior and characteristics of the components and circuits on a PCB.

Digital multimeters are fundamental tools for running continuity tests, measuring resistance, checking voltages and verifying basic components such as diodes and capacitors. Logic analyzers are more advanced devices that capture and analyze multiple digital signals simultaneously, with capabilities such as sample rates of up to 500 MS/s, built-in protocol analysis and deep data storage. Portable oscilloscopes complement these tools by displaying signal waveforms, making it easier to analyze characteristics such as rise time, fall time and behavior under different conditions.

For more specialized analysis, circuit test equipment such as in-circuit test (ICT) systems can verify full circuit functionality by applying specific signals and measuring the responses, although they require direct physical access to the PCB's test points.

Specialized analysis software

Specialized software significantly boosts analytical capabilities in hardware security, making complex data easier to interpret and findings easier to document. PCB design tools such as KiCad or Altium Designer, although originally intended for development, are just as valuable for reverse analysis, allowing you to recreate schematics from physical observations and document the connections you identify.

For signal analysis, software such as PulseView or the Saleae Logic suite can visualize and decode communication protocols captured with logic analyzers, automatically recognizing UART, SPI, I2C and other common protocol patterns. Component databases such as Octopart make it quick to identify chips by part number, providing immediate access to full datasheets and technical specifications. For analyzing extracted firmware, tools such as Ghidra, IDA Pro or Binary Ninja let you disassemble and analyze the code, identifying functions, data structures and potential vulnerabilities that could be exploited through the hardware.

Equipment for firmware extraction and analysis

Firmware extraction and analysis is a critical phase in hardware security audits, requiring specialized equipment to access, dump and examine the code that controls the device. Universal programmers such as the CH341A, EZP2019+ or TL866II Plus support a wide range of memory chips, allowing you to read and write the contents of EEPROM, SPI flash or NOR/NAND memory with the appropriate adapters. To access debug interfaces such as JTAG, USB-JTAG adapters such as the J-Link, Bus Pirate or FT2232H provide the necessary connectivity between the analyst's computer and the target, making firmware extraction possible even on devices with basic protections. Hardware hacking probes such as the Shikra or Glasgow make it easy to connect to various protocols such as UART, SPI, I2C and JTAG, often with level-shifting capabilities to adapt between voltage levels without damaging components. For more complex cases that call for advanced techniques such as fault injection, specialized equipment such as the ChipWhisperer makes it possible to synchronize precise attacks with specific device operations, potentially defeating sophisticated security mechanisms.

Final thoughts...

Detailed analysis of printed circuit boards is the cornerstone of any hardware security audit, providing the understanding needed to identify and exploit potential vulnerabilities. Thorough visual inspection, detailed component identification, trace analysis and rigorous documentation form a methodical process that reveals the device's internal architecture and its possible attack vectors. Advanced tools such as digital microscopes, logic analyzers, multimeters and memory programmers enhance these analytical capabilities, enabling an in-depth assessment of hardware security.

In security, prior knowledge is not merely useful but essential for carrying out precise, effective interventions. A systematic, well-documented analysis makes it possible to focus efforts on the system's most vulnerable points, saving valuable time and resources in the later phases of the audit. The advanced methodologies presented in this report provide a structured framework for turning the inherent complexity of embedded systems into a manageable set of components and connections that can be analyzed methodically to uncover and address security vulnerabilities.

Topics

#Circuits #Hacking-Hardware #Hardware #Industrial-hardware-security

Keep reading

Talk to us about OT security