Analyzing Embedded Systems The Smart Way | Henrik Ferdinand Noelscher | Hardwear.io Webinar

### Overview In this Hardwear.io webinar presentation, Henrik Ferdinand Noelscher discusses efficient methodologies for reverse engineering embedded systems, focusing on printed circuit boards (PCBs). Embedded hardware analysis traditionally begins with tearing down a device and manually inspecting components, tracing connections, and looking up documentation—a process that can be tedious, error-prone, and time-consuming. Noelscher proposes automating component identification, part number recognition, and technical documentation retrieval to reconstruct high-level schematics quickly and accelerate the testing pipeline.

### Key Topics - **Targeting Active Components**: Prioritizing integrated circuits, microcontrollers, and flash storage over passive parts (such as resistors and capacitors) to identify firmware execution and data storage locations. - **Optimized PCB Imaging**: Capturing high-resolution images of PCB front and back layers using clean boards, proper lighting, low ISO, long exposure times, and minimal background space to facilitate automated analysis. - **Automated Component Detection**: Implementing color-based segmentation and rectangular fitting to identify chip packages, paired with template matching to locate repeating components across orientations. - **OCR and Part Number Resolution**: Extracting text from chip surfaces via optical character recognition, handling noise with character length thresholds, and resolving authentic part numbers using catalog databases and naming schemas. - **Unlabeled and Rebranded ICs**: Analyzing physical chip package dimensions and power/ground supply pin layouts to identify custom-labeled or scraped chips based on known manufacturer designs. - **Automated Data Gathering**: Scraping and structuring datasheets, pinout tables, IDE definitions, and reference manuals to surface debugging ports (such as JTAG), communication buses, and architecture details. - **Hardware Netlist Extraction Techniques**: Comparing low-overhead non-destructive approaches with advanced methods like PCB delayering, X-ray imaging, and automated flying-probe testing.

### Technical Details To isolate chips on a circuit board, the system blurs high-frequency noise and removes background solder mask colors (such as green) using pixel thresholding. Rectangles are fitted over the remaining segmented blobs to delineate chip boundaries. For passives or missing components, template matching calculates similarity metrics across the board and supports rotation-invariant detection. Extracted chip images are fed into OCR services, filtering out artifacts and matching against catalog patterns (e.g., STM32 naming schemes). For Ball Grid Array (BGA) components, table extraction converts package diagram matrices into structured pinout lists that can be mapped over the PCB layout. When extracting documentation, converting PDFs into HTML, images, and text allows regular expressions on tables of contents and keyword searches (such as targeting JTAG or UART) to automatically segment and index critical chapters.

### Takeaways Automating the early reconnaissance steps of hardware analysis reduces back-and-forth between the workbench and the computer while minimizing missed attack vectors. Analysts do not need complete physical netlists to begin firmware extraction; partial schematic reconstruction identifying key interfaces (e.g., SPI flash connections, UART lines, debugging interfaces) provides sufficient leverage for penetration testing. High-quality imaging and small, modular automation tools significantly enhance analysis speed and thoroughness.