UNDERSTANDEVERY LAYER,DOWN TO THE BIT.
We reconstruct what was built, recover what was lost, and decode what was hidden.
Reverse engineering reconstructs design intent from physical artifacts — delaminating a PCB to recover every layer, extracting firmware from a locked microcontroller, and decoding undocumented protocols from oscilloscope captures. Ankh conducts hardware reverse engineering for competitive analysis, legacy documentation recovery, obsolescence-driven redesign, and IP-avoidance clean-room clone development — combining electrical engineering, firmware analysis, and protocol decoding with forensic methodology to produce defensible results.
What We Reverse Engineer
PCB Delamination & Schematic Reconstruction
Layer delamination, high-resolution flatbed scanning (up to 6400 DPI), and X-ray CT for fine-feature boards — every copper layer traced into Altium, KiCad, or Cadence with vias, pads, and component footprints mapped to net names, cross-validated against resistance, capacitance, and signal-path continuity measurements.
Firmware Extraction & Binary Analysis
Firmware extracted via JTAG (IEEE 1149.1), SWD, ISP, UART bootloaders, and debug-port unlock techniques for specific MCU families (STM32, nRF52, LPC, ESP32, PIC) — binaries analyzed in Ghidra and IDA Pro with architecture-specific processor modules, identifying function entry points, configuration tables, and cryptographic key material.
Protocol Reverse Engineering
Protocol decode using Saleae Logic Pro 16, Keysight MSOX3000, and SDR — physical layer characterization (baud rate, encoding, framing), data link frame reconstruction, and application-layer message decode delivered as a spec with FSM diagrams, message format tables, and timing specifications.
IC Identification & Datasheet Research
IC identification via optical die inspection (decapping when necessary), silicon dating, pinout cross-referencing, and functional characterization (I/O voltage levels, clock frequencies, protocol signatures) — with access to over 15,000 device family records.
BOM Reconstruction & Obsolescence Analysis
BOM reconstruction with passive values and semiconductor part numbers — cross-referenced against distributor inventory with lifecycle status, last-time-buy date, and alternative part recommendations for end-of-life components.
Clean-Room Redesign & IP Avoidance
The analysis team produces functional specifications (behavioral descriptions, interface protocols, performance parameters) without circuit-level detail, and the design team implements a new design from that specification using independently selected components — producing a legally defensible clean-room record.
Legacy Product Documentation Recovery
Engineering documentation recovered by reverse engineering the physical product — schematics, BOMs, and firmware images at a detail level sufficient for component substitution, test fixture repair, and regulatory re-submissions.
Competitive Analysis Teardowns
BOM reconstruction with should-cost pricing, PCB process characterization (layer count, feature size, surface finish, via technology), IC supplier identification, and certification marking review — synthesized into a competitive technology report.
How We Work
Scope Definition & Legal Review
Objectives, legal context (device ownership, IP agreements, jurisdiction-specific rights), and required deliverable format are established before any analysis begins. Client attestation of lawful ownership is required; for competitor product engagements, DMCA Section 1201 exemptions and defensible IP avoidance documentation practices are reviewed.
Physical Inspection & Documentation
High-resolution photography of packaging, connectors, labels, and PCB surfaces precedes disassembly, with X-ray imaging for BGA devices or stacked modules. All original component locations are catalogued before delamination; chain-of-custody documentation tracks every physical sample from receipt through analysis to final disposition.
Hardware Analysis
Analysis proceeds in layers — IC identification, power topology mapping, peripheral identification by probing reset sequences and bus activity. PCB delamination exposes each copper layer for scanning; the reconstructed schematic is verified by comparing measured voltages, clock frequencies, and bus waveforms against expected circuit behavior.
Firmware Extraction & Analysis
Unprotected devices use JTAG or ISP; read-protected devices are evaluated for voltage glitching, EMFI, or software vulnerability techniques based on MCU family and protection level. Binaries are analyzed in Ghidra or IDA Pro, signatures matched against ARM CMSIS, FreeRTOS, and mbedTLS to isolate proprietary handlers.
Protocol Decoding
Physical layer characterization — pin identification, signal levels, frame boundaries — precedes data link decoding of delimiters, length fields, CRC polynomial, and address bytes. Application-layer message types, payload encoding, and command/response relationships follow; wireless protocols are captured with Ubertooth, HackRF, or TI SmartRF.
Documentation & Deliverable Preparation
Deliverables are prepared in the agreed format — native CAD schematics, annotated BOM with alternative part recommendations, firmware binaries with disassembly listings, protocol documentation with FSM diagrams, and clean-room functional specifications. All deliverables are reviewed by a senior engineer not involved in primary analysis.
Forensic Precision Across Hardware and Software
MCU Debug Unlock & Firmware Extraction Techniques
Most MCU readout protection has known bypass vectors: VFI targets the security monitor supply during the protection check (documented against STM32F1/F2/F4 RDP Level 1); EMFI injects localized upsets via a focused coil over the die; TrustZone-M devices are evaluated for non-secure debug misconfigurations. All attempts are documented with technique and outcome.
Embedded SecurityPCB Layer Recovery: Delamination to CAD
Multi-layer recovery uses precision lapping with 6400 DPI scanning per layer; X-ray CT (Nordson DAGE or Matsusada) images 8–12 layer BGA boards non-destructively to preserve functional testing. Layer images are imported into Altium or KiCad and back-annotated with net names from measurement data.
Electronics DesignUndocumented Protocol Reconstruction
Passive logging of 10,000+ frames builds a statistical model of frame lengths and header patterns; differential analysis across operational states separates state-dependent from fixed fields. CRC polynomial identification brute-forces 200+ known variants; a software simulator injects test messages to disambiguate command semantics, and GNU Radio captures proprietary wireless links.
Firmware Development
We reconstruct what was built, recover what was lost, and decode what was hidden.
Reverse Engineering Across Ankh's Product Range
Reverse engineering needs arise across every hardware category — from legacy documentation recovery to obsolete chipset redesign to competitive analysis.
Medical Devices
Legacy diagnostic device documentation recovery for regulatory re-submission and sustaining engineering support
View ProductIndustrial Equipment Monitoring
Legacy PLC and fieldbus gateway documentation recovery, obsolete IC redesign, and Modbus/PROFIBUS protocol reconstruction
View ProductWearable Electronics
Competitive wearable teardown with BOM cost estimation, sensor IC identification, and MEMS package characterization
View ProductWireless Communication
Proprietary RF protocol decode from OOK/FSK captures, FCC ID grant cross-reference, and antenna topology identification
View ProductAI Vision Systems
Camera module ISP pipeline reconstruction, NPU firmware extraction, and model architecture identification from binary weights
View ProductPOS & Kiosk Hardware
Legacy kiosk controller documentation recovery and peripheral interface protocol decode for third-party software integration
View ProductData Loggers
Obsolete data logger redesign with reconstructed BOM and firmware functionality reconstruction from binary extraction
View ProductPower Monitoring
Metrology IC identification from unlabeled packages, calibration routine reconstruction from firmware binary, and communication protocol decode
View ProductSmart Home Automation
Proprietary hub-to-node protocol reconstruction for third-party device integration and competitive feature analysis
View ProductRuggedized Devices
MIL-spec connector wiring reconstruction, conformal coating removal for layer access, and legacy GPS receiver firmware recovery
View ProductCold-Chain Monitoring
Sensor calibration coefficient extraction from firmware binary and data logger communication protocol reconstruction for cloud integration
View ProductMulti-Discipline Team: Hardware, Firmware, and Protocol in One Engagement
Complex device reverse engineering requires simultaneous PCB, firmware, and protocol expertise — rarely combined in one team. PCB engineers, security researchers, and protocol analysts work the same device simultaneously, correlating hardware anomalies with firmware behavior in real time and accelerating analysis by 40–60% versus sequential hand-offs.
Documented Clean-Room Process for IP-Safe Redesigns
Legally defensible separation between analysis and design activities avoids trade secret misappropriation in redesign engagements. Independent teams, documented information barriers, and functional specifications describing behavior without circuit-level detail produce a chain-of-custody record accepted by IP counsel across multiple jurisdictions.
Extracting Firmware From Locked Devices Without Destroying Them
Non-destructive extraction from read-protected MCUs requires careful methodology to avoid permanently locking the device. Tooling for 20+ MCU families — sub-nanosecond voltage glitching rigs, package-matched EMFI coils, and software fault injection — achieves 85%+ success on known-extractable targets, with probability communicated before fees are charged.
Deliverables
Reconstructed Schematic Package
Schematic in Altium, KiCad, or PDF with nets named and power rails annotated — with layer-image archive and via-registration verification documentation.
Bill of Materials with Alternates
BOM with manufacturer part numbers, lifecycle status, and recommended alternates for obsolete components — with should-cost estimate at 1K and 10K volumes.
Extracted Firmware Image
Raw binary firmware image(s) with extraction method documentation, hash verification, and optional disassembly annotated with identified functions and protocol handlers.
Protocol Documentation
Complete protocol specification: physical layer parameters, frame format tables, FSM diagrams, command/response tables, CRC algorithm, and timing diagrams — formatted for direct use by firmware developers.
Competitive Teardown Report
Executive summary with strategic implications plus BOM cost estimate, manufacturing process characterization, IC supplier intelligence, and regulatory status.
Clean-Room Functional Specification
Functional specification describing system behavior, interface protocols, and performance requirements without circuit-level detail — the IP-safe transfer document between analysis and design teams.
Obsolescence Redesign BOM & Schematic
Updated schematic with replacement components integrated, including circuit modifications for pin-compatible or form-fit-function replacement ICs.
Methodology & Chain-of-Custody Record
Complete analysis methodology documentation covering tools used, personnel, information barriers maintained, and intermediate findings — supporting legal, IP, and regulatory review.
All reverse engineering deliverables are provided with a technical accuracy statement and methodology documentation supporting use in legal, regulatory, and engineering contexts.
Often Paired With Reverse Engineering
Electronics Design
Clean-room functional specifications feed directly into electronics design, with IP separation maintained between analysis and design teams.
ExploreFirmware Development
Protocol documentation and functional specifications recovered through reverse engineering enable Ankh's firmware team to implement compatible or replacement firmware.
ExploreEmbedded Security
Firmware extraction and binary analysis findings inform security assessments and hardening recommendations for the target product and your own designs.
ExploreSustaining Engineering
Reconstructed schematics and BOMs from documentation recovery enable sustaining engineering for products whose original design files no longer exist.
ExploreWork That Demonstrates the Standard
Legacy Medical Instrument: Documentation Recovery & 510(k) Re-Submission
Ankh delaminated three boards to recover a 10-layer schematic, identified all 47 ICs via die inspection and functional characterization, extracted firmware from two STM32F4 MCUs via JTAG, and produced a complete annotated disassembly of the 128 KB image. The resulting documentation package supported a 510(k) update submission cleared without additional information requests.
Read the Case StudyProprietary Industrial Protocol Decoded for Third-Party Integration
Ankh captured 500,000 RS-485 frames via Saleae Logic Pro 16 passive tap, identified a custom 11-byte framing structure with a CRC-16/MODBUS polynomial, and decoded 47 command types by correlating frame contents with observable machine state. The resulting Python reference implementation saved the client an estimated $340,000 in controller replacement costs.
Read the Case StudyNeed to Understand What Was Built—or What a Competitor Built?From silicon to binary—we reconstruct the full picture.
Ankh begins every reverse engineering engagement with a feasibility assessment giving a clear probability of success and timeline before work begins.