Live Reverse Engineering

I started in electronics before the advent of the internet and most solid state components, so getting datasheets and schematics was not easy for me. Today with manufactures making custom ICs and LCDs for everything from phones to video games, tinkers that salvage components from old electronics are faced with a new challenge. The schematics and datasheets for custom components are just not available. Even though these components can be obsolete by the time you are salvaging the parts you still can’t get the data sheets. This is where reverse engineering comes to play making schematics and datasheets with pinouts on desired components you can’t get datasheets for.

Now I get a lot of electronics out of the waist bin that work, so when you see a component you like don’t just take the component out of the circuit board and expect to find a datasheet for it, sometimes that works and many times it doesn’t. Find out if it works first.

When I wrote my Instructable Salvaging Liquid Crystal Displays, I was asked about pinouts of LCDs.

https://www.instructables.com/id/Salvaging-Liquid-Crystal-Displays-LCDs/

Many of my replies to these requests for pinouts were to tell them to follow my Instructable Reverse Engineering.

https://www.instructables.com/id/Reverse-Engineering-1/

That Instructable works for displays if you can look up the other components on the circuit board, this Instructable is about finding the pinouts when you can’t look up the key components or can’t find the datasheets.

This Instructable will not teach you the codes that make a component work; nor will it teach you how to get past one time programmable ICs or locked ICs. It will teach you how to find some if not all the functions of a components pinouts.

1. Screwdriver to disassemble the housing.

2. Multimeter for checking voltages.

3. Soldering gun for surface mount components you may need two.

4. Oscilloscope for checking signals.

5. PCB holder

6. Safety Glasses

7. Sand Paper

A logic analyzer would be better for analyzing the data inputs as logic circuits function on true current and the signals will look the reverse with an oscilloscope.

You may find yourself with a phone like this one and go, “Oh boy what a nice LCD display.” And take the display out only to discover you can’t get a datasheet for the display. If you had the forethought to keep the circuit board so you could reverse engineer the circuit board and you then discover there are four key components you can’t get datasheets for.

The COG LCD 8 pin 1 custom bar 2 X 14 digit 5 X 7 segment alphanumerical bars.

The Transmitter

The eight pin IC L326U79W

The eighty pin IC SC14431

Of these four components I could only get the datasheet for a SC14408 IC and I was not sure if it had the same pinout.

In my case I had three of the same phones so I did a Live Reverse Engineering.

Start by charging the battery, I had a number of them so I picked one that held a charge for at least one hour, this phone will not work when you push the buttons while it is charging the battery or without a battery, so I needed a working battery.

To live test you need to remove the circuit from the phone housing. Start by removing the battery cover, and take out the battery and the screws holding the back of the phone housing to the front of the phone housing.

Keep the battery.

Next open the phone housing and remove any screws holding the circuit board to the front of the housing.

Remove the circuit board and the key pad buttons you need the key pad buttons for testing.

Pop the speaker off the back of the housing.

Once you have the circuits, battery, and key pad buttons you can toss the housing into your scrap plastic bin.

Since I did not need the speaker or the earpiece for testing I removed them, if you desolder the connections make sure you do not short the connections with solder.

Last I removed the earpiece bracket to expose the COG LCDs terminals.

Reattach the battery and mount the circuit board into the PCB holder. Start with a Multimeter measure and record the voltages one pin at a time.

Pin 1. 2.8 Volts negative

Pin 2. 0 volts

Pin 3. 2.3 volts positive

Pin 4. 2.3 volts positive

Pin 5. 2.3 volts positive

Pin 6. 2.3 volts positive

Pin 7. 2.3 volts positive

Pin 8. 2.3 volts positive

A logic analyzer would be best for analyzing the signal inputs but you can use an oscilloscope and record the results to get the same information. Set your oscilloscope for scan at a speed you can see the data stream when you push one of the buttons.

Pin 1. No signal 2.8 Volts negative

Pin 2. No signal 0 volts

Pin 3. No signal 2.3 volts positive

Pin 4. No signal 2.3 volts positive

Pin 5. Signal 2.3 volts positive

Pin 6. Signal 2.3 volts positive

Pin 7. Signal 2.3 volts positive

Pin 8. Signal 2.3 volts positive

Next check the display response by changing the signal inputs and recording the response. You don’t need to record everything the display does just if it changes or not and if the display goes out. Since Pin 1 is negative voltage and no signal, and pin two is 0 voltage and no signal we can assume they are Vss. and ground.

Pin 3 and 4 are fixed high so start with Pin 5 checking one pin at a time, fix the voltage too high, or in this case 2.3 volts and observe what happens to the display.

Record the response of pin 5 then move to Pin 6 fixing it to high then observe the response on the display and record it. Continue with this process for pin 7 and pin 8. The changes on the display were funky symbols in the alphanumeric segments and random lighting up of the custom bar. You may notice the response only affects the custom bar or the alphanumeric bars make note of that because the pin data inputs may be bar specific.

Starting with Pin 3 start checking one pin at a time, fix the voltage to low or in this case 0 volts and observe what happens to the display. Pin 3 and 4 when set low shut down the display, pins 5 to 8 when set to low or 0 volts made different symbols in the alphanumeric segments, and different random lighting up of the symbols in the custom bar.

What this did was to corrupt the data inputs set the enable to disable and the Vdd. to 0 volts. At this point I know what 6 of the 8 pins are and what they do.

Pin 1. Vss

Pin 2. Gnd

Pin 3. ???

Pin 4. ???

Pin 5. D0

Pin 6. D1

Pin 7. D2

Pin 8. D3

Pin 3 and 4 I suspect are Enable and Vdd. but to find out which is which I will need to trace the circuits.

If you only have one circuit board; take a good photograph of the circuit board before and after you take the components off the circuit board. Since I had three of these phones I had one fully assembled on the charger to keep the battery charged. One phone partially dissembled for reference and one I striped for testing and tracing.

After removing the COG LCD I made notes on the backlight LEDs and removed all the components putting aside the components I wanted.

Remove the ink, paint, and lacquer, covering the circuits so you can see the conductors better. I have tried every compound, stripper, and solvent I could buy in the store, none of them worked at removing the ink or lacquer on these circuit boards. So I sanded the boards clean, photographed both sides and traced the circuits in paint on my computer.

I compared the pinouts of the SC14431 IC with the SC14408 IC datasheet and I was glad I did not rely on the datasheet for my pinouts none of the pinouts from the SC4431 that I knew were Ground, Vss, or data matched with the SC4408 IC datasheet. However I was able to tell which pin on the LCD was Vdd and enable.

Pin 3 went to multiple components denoted by the C in the box until it traced to the positive of the battery.

Pin 4 went to pin 28 of the SC14431 IC only, this told me it had to be enable.

Pin 1. Vss
Pin 2. Gnd

Pin 3. Vdd

Pin 4. Enable

Pin 5. D0

Pin 6. D1

Pin 7. D2

Pin 8. D3

There you have a minimal datasheet for an unknown COG LCD connected to unknown ICs with a basic connection schematic using Live Reverse Engineering.

Although this LCD looks like a Nokia Graphic LCD it is a custom LCD with two 15 digit alphanumeric bars and two custom bars. Even after I live reverse engineered this LCD I could not find the code to make it do what I wanted. I tried the Nokia graphic codes and pinouts on this LCD using Arduino. The Arduino codes and the pinouts did not work on this Nokia look alike LCD. Do not look at a component and assume it is the same as it looks.

Unlike the first phone in this Instructable the only parts I could not find datasheets for were the transmitter, LCD, and the one resin coated IC.

Just like the first phone I exposed the LCD terminals and checked the voltages with a multimeter. Recording the voltages I found voltages twice that of the battery.

Pin 1. 3.3 volts when button pushed.

Pin 2. 3.3 volts.

Pin 3. 3.3 volts when button pushed.

Pin 4. 0 volts.

Pin 5. 3.3 volts.

Pin 6. 6.17 volts.

Pin 7. 6.17 volts.

Pin 8. 3.3 volts.

Pin 9. 6.17 volts.

On this circuit board with the oscilloscope I got two intermittent signals and three constant signals.

Pin 1. Signal when the button was pushed 3.3 volts.

Pin 2. Constant square wave 3.3 volts.

Pin 3. Signal when button pushed 3.3 volts.

Pin 4. No signal 0 volts.

Pin 5. No signal 3.3 volts.

Pin 6. No signal 6.17 volts.

Pin 7. Constant square wave 6.17 volts.

Pin 8. Constant square wave 3.3 volts.

Pin 9. No signal 6.17 volts.

Just like the first circuit board I took photos removed the parts made notes on the backlight LED and cleaned the circuit board to trace the conductors in paint on my computer. Once I had the circuit feeding the LCD I had all the pinouts but the one to the resin coated IC and it was not hard to deduce it was reset or enable.

Pin 1. Resin coated IC.

Pin 2. Serial clock on IC AMTH 004.

Pin 3. Serial data on IC AMTH 004.

Pin 4. Ground.

Pin 5. Vcc.

Pin 6. High voltage and a capacitor to pin 5.

Pin 7. High voltage square wave and a capacitor to pin 8.

Pin 8. Low voltage square wave.

Pin 9. High voltage.

For the last little bit I disassembled the LCD making notes of its construction and made a simple datasheet with a connection circuit.

Finding the pinouts of a component is not impossible without a datasheet when you use reverse engineering, but datasheets do make life easer.

Last you will find coding a challenge because it is; 10010100 is 42 or the alphanumerical sun of "To Be". The answer to life, the universe, and everything.