reverse engineering lcd display free sample

I first saw this screen on the ZBD EPOP 900 electronic shelf label (ESL). Thought it is going to be fun just reverse engineer them, so I bought a few of them:

The PCB is not very complex, it is a small 2-layer PCB, with only one TI CC1110 MCU controlling everything. With some tracing, it is clear how the LCD is connected to the MCU. MCU also has control of the LCD voltage regulation and LCD bias generation. These are important information that will be used later.

M (Also called FR), a signal only present on passive matrix LCDs, defines the polarity of the driver. Toggle this pin would switch the output polarity. Screens are driven in AC by toggling this pin to avoid polarization.

There are some additional help I can get from the LCD"s ribbon cable, by following the trace there I can know which pins are for the segment, and which pins are for the common.

Well it might sound like it was quite easy reverse engineer it, it was not. I wasn"t aware that the voltage was controllable (thus not aware that I have the voltage entirely wrong), and I didn"t realize that both P15 and P17 are both LP at first, caused lot of confusion at first. At the end I spent lot of time fighting with air. I am glad eventually I have sorted everything out.

At 11 June 2013, 13:42:13 user Allan wrote: [reply @ Allan]Very interesting. Thanks for taking time to make these videos. What exactly does your breadboard circuit do in order to shift (scroll) to the next scan line on the LCD ?

At 24 August 2012, 7:22:43 user Giorgos Lazaridis wrote: [reply @ Giorgos Lazaridis]@kiranvarma-npeducations which software do you mean? The PIC software? It is very messy and i made it only for testing the LCD. If this is what you want, i can certainly give it to you. But it is not commented.

At 3 July 2012, 8:36:44 user kiranvarma-npeducations wrote: [reply @ kiranvarma-npeducations]Is that software shown in video is designed by you, its cool! simply generating binary code for bitmap images and serializing.. to LCD panel via some controller (i think from Philips). Which language that u have used to develop software. Final output in LCD panel is mind blowing, you are genius in both software and hardware part. Really amazing video, really reverse engineering. Thanks for such wonderful project tutorial. I will bookmark your site for my learning benefit

At 6 May 2012, 20:31:17 user Giorgos Lazaridis wrote: [reply @ Giorgos Lazaridis]@sdfdsfadsjk But first i will finish my coffee maker for which this LCD is supposed to go. But due to lack of funds, the project will be delayed for a while.

At 21 November 2011, 5:41:30 user Kammenos wrote: [reply @ Kammenos]@Annonymois sure there are methods for this, but not by hacking the LCD that way. There are programs for example for PCs and others for telephones to do this, there are also very VERY cheap gadgets (http://www.ebay.com/sch/?_kw=gsm%20spy&_clu=2&_fcid=5&_localstpos=&_sop=15&_stpos=&gbr=1). If i were you, i would start with a simple PC format, and then install a firewall on the PC. Any surveillance program installed would then be erased.

At 20 November 2011, 22:10:52 user Annonymois wrote: [reply @ Annonymois]Hi. I saw your YouTube video about reverse engineering an LCD screen. And some posters had said this process is used by hackers in order to spy on people through their computer screens? And I started googling this questions because I perceive I am being watched by people I know. I don"t know how. I suspect there is a website where the hackers stream the audio and visuals to the recipients who include friends and so-called family members. They drop subtle hints to me as to the fact they they know what I"m doing by posting comments on YouTube videos I"ve just watched or they repeat the words I"ve just spoken by writing it down on my Facebook wall or in my junk email subject line. If you google gang stalking, cause stalking, gas lighting, you will see that there are a lot of people who are experiencing electronic surveillance. It"s crazy. I know I saw a real life police show once and they were receiving visual feed from the cell phone of a criminal. I don"t know how they did it. But I have been abused by people I know at work and in the last year by my own family because they used to like / love me and now they hate me. My brothers family in particular and my nephew from my sister have been befriended by these cause stalkers and they constantly let me know I"m being watched. They don"t admit it but I"ve heard them talk about private conversations I"ve had when they were no where near me! It"s crazy.

I finally got my display working! It"s only 160x80 so I can get great refresh rates from a pic... right now the controller is an 18f2455 and i"m using it"s internal ram for the display. Currently it only displays a test image that I stored in program memory, but I plan to add a 5x7 font, a gal for timing logic, external serial display ram, and serial character input... then I"ll use it for console output on a couple of hacked linux devices. Thanks for all the information!!

I have obtained a large (200-300) lot of bare LCD Screens (no driver/controller boards). About half of them are 3.8" Sharp LQ038 screens. These were stored loose in a box and many are obviously broken. I would like to do something with these and I am at this point looking for a simple circuit so that I can test them, also possibly a way to turn them into digital photo frames. I am an Electrical Engineer, but it has been a while since I have done detailed component work like this and I have never worked with Color LCD displays before. Can someone direct me to where I can find some circuit designs that I may be able to use?

At 2 August 2011, 18:30:42 user Tom wrote: [reply @ Tom]Just recently got back to my lcd project... The M signal is to drive the LCD voltages: the col/seg drivers use it to alternate the voltage applied to the cells, otherwise the lifespan is shortened. The pic simply alternates M from high to low every frame.

My lcd is only 160x80, and I"ve generated a test image with a pic18f2455... I"m only running at 20MHz right now but the refresh rate is good because it"s a much smaller screen. Thanks again!!

At 12 April 2011, 21:00:08 user jparker wrote: [reply @ jparker]You are very good at debugging (reverse engineering). I like your honesty when you talk about your projects/experiments. You also inspire me to explore some of my broken devices parts. Hang on to the curiosity you have and it will be kind to you in the future I"m sure. Thx for the website.....

My first monochrome LCD, like yours, didn"t have a smart controlle, I put the LC7981 controller on it and it worked. My second monochrome LCD was this:

I had to do a change there. It"s been a long time and I don"t remember but here is bottom line: The SED1335 supports a 16 bit address bus and the memory on this LCD is only 8 kBytes. I found an 32 kBytes RAM with the same layout as the 8 kBytes. The difference was that the 8 kBytes RAM had two NC lines in the place of the two extra address lines on the 32 kBytes RAM. So, I replaced the RAM, hardwired the NC pins to the correct SED1335 pins and it worked perfectly :)

At 27 March 2011, 21:10:58 user Tom wrote: [reply @ Tom]Nice work! You gave me the idea to work on my own 160x80 lcd which has the same common and segment driver. Two questions if you don"t mind...

2. what is the M pin (pin 94 on the 79430 and pin 86 on the 79401) on your lcd connected to? i have a pin on my connector that goes to M on the drivers and i"m not sure what to do with it... the specs say M is an input - "LCD drive output alternating current (AC) signal"

You can have a 32MHz INTOSC (8MHz with 4x PLL; see section 5.2.2.6 of the 16F1934 data sheet). You can also use the MSSP to fetch bytes from the external memory for you at one bit per CPU cycle while sending the previous byte to the LCD, or get display data from internal program memory or even RAM instead.

Of more interest is that with small changes you can store tiles in program memory for easy character display. It is slightly slower, but can (barely) achieve 50Hz screen refresh with a fully tile-based screen layout. For example, code to choose among 64 tiles, 16x16 pixels in size (2kword program memory), might look like:

Next check the display response by changing the signal inputs and recording the response. You don’t need to record everything the display does just if it changes or not and if the display goes out. Since Pin 1 is negative voltage and no signal, and pin two is 0 voltage and no signal we can assume they are Vss. and ground.

Pin 3 and 4 are fixed high so start with Pin 5 checking one pin at a time, fix the voltage too high, or in this case 2.3 volts and observe what happens to the display.

Record the response of pin 5 then move to Pin 6 fixing it to high then observe the response on the display and record it. Continue with this process for pin 7 and pin 8. The changes on the display were funky symbols in the alphanumeric segments and random lighting up of the custom bar. You may notice the response only affects the custom bar or the alphanumeric bars make note of that because the pin data inputs may be bar specific.

Starting with Pin 3 start checking one pin at a time, fix the voltage to low or in this case 0 volts and observe what happens to the display. Pin 3 and 4 when set low shut down the display, pins 5 to 8 when set to low or 0 volts made different symbols in the alphanumeric segments, and different random lighting up of the symbols in the custom bar.

Welcome to what will probably be the last in the series of articles in which I reverse engineer one of the Nokia QVGA cellphone displays from the pre-smartphone era. I think that by now I’ve covered every possible aspect of these incredibly cost effective little displays and hopefully opened up new avenues for hobbyists needing a richer display experience than they can get with a simple character LCD.

If you’ve been following these articles then you’ll know that I’ve successfully reverse engineered the 2730, 6300, N82 and N95 8Gb displays. Each one is readily and cheaply available on ebay making them ideal for incorporation into your microcontroller projects. All of my reverse engineering efforts have been accompanied by free, open-source libraries for the Arduino and the STM32.

In this final article I will tackle the N93 2.4″ display, which at the time of writing is available for just a few pounds, dollars or euros on ebay. Let’s see how I get on.

The physical LCD is the same layout as all the previous Nokia LCDs that I’ve tackled. A short FPC cable runs from the LCD and is terminated by a board-to-board connector at the end.

The type of connector is usually a primary source of concern when reverse-engineering a cellphone LCD. Fortunately for me I discovered early on that the 24-pin 0.4mm pitch connector is made by a company called JST. The part number is 24R-JANK-GSAN-TF. Here’s the datasheet.

Determining the connector pinout was not difficult. A little googling quickly unearthed the cellphone repair manual and schematic. Once the LCD connector was located in the schematic it was a simple matter of matching up pins 1..24 with the physical device.

It’s become something of a tradition for me to prove the reverse engineering by designing a development board for the Arduino Mega and I’ll continue that tradition here.

Before producing the LCD development board I verified that the level conversion strategy would work by hacking up some wires to the leads of the IC and verifying that an input level of 5V would be correctly converted down to 3.3V.

The schematic image shows the display connector, level converter, backlight circuit and arduino connector all linked together. I decided to add a small amount of capacitance to the active-low RESET line to enhance its stability. I’ve never seen any unexpected resets in any of my boards but I note that all the official Nokia schematics add capacitance here so I’ve followed suit this time.

The most critical part of this layout is the positioning of the LCD connector. It has to be accurately placed so that the LCD, when connected, wraps around the board and sits perfectly on the other side mounted on double-sided sticky pads to lift it clear of the board traces. In the above image pin 1 of the LCD connector is down the bottom right.

Only now, several weeks after starting do I get to see if the whole thing works. I’m hopeful though, given the success of the previous reverse-engineering efforts.

I quickly determined that the LCD controller is much the same as the 2730, 6300 and N82 with only minor differences around the commands that control the orientation. We don’t really know the official identity of this controller but it’s close enough to the MagnaChip MC2PA8201 that we can work from its datasheet with a high degree of confidence.

Here’s a short demo video on YouTube that shows the LCD board in action. Click on the ‘YouTube’ logo at the bottom right to watch it in a larger format at the YouTube site.

I’ve constructed the remaining PCBs that I have and am selling them on a first come first served basis. The price including delivery is £16.90 for UK and £18.49 for anywhere else in the world. They come with the LCD fitted and are ready to plug in and play. The LCD is one of the high quality ‘original Nokia’ models described in the above article.

The current marketplace allows hobbyists to easily find inexpensive, well-documented displays, but what if you wanted to interface with something more complicated, such as the screen on an iPod Nano 6? [Mike] has given us a detailed and insightful video showing his process for reverse engineering a device with little-to-no documentation. Here he covers the initial investigation, where one scours the web in search of any available information. In [Mike’s] example, the display uses an MIPI D-PHY interface, which he has never worked with. He learns that the MIPI Alliance will provide design specs in exchange for a signed NDA (Non-Disclosure Agreement) and a modest $8000 fee. Nice.

[Mike] shows off some serious hardware hackery, tackling some extremely difficult soldering in order to set up a proper test platform. He then demonstrates how to use a rather awesome oscilloscope to better understand the display protocol. We found it fascinating to see the video signals displayed as waveforms, especially when he shows how it is possible to count the individual binary values. The amount of information he uncovers with the oscilloscope is nothing short of amazing, proving these little devices are more complex than they seem.

This article is for colleagues who are interested in studying the reverse engineering of embedded devices starting from the introduction of equipment that can be used to assist the process of reverse engineering. Communication protocols and interfaces are often used in embedded devices as well as some other important things. Reverse engineering of the embedded device itself aims to find out how it works, looking for possible but and the possibility of activating or adding features that found on the device

An oscilloscope is a device that can be used to observe changes in the signal in a certain period. The signal on the oscilloscope displays as a comparison of voltage with time. There are several types of oscilloscope in circulation. Initially, you can use a USB oscilloscope connected to your computer and using applications on the computer to display the signal. There is also a bench oscilloscope, an oscilloscope that has an integrated monitor.

TRST (Test Reset) is a pin, which is optional, where its function is to reset the TAP interface. It should be noted that it is only in the form of a JTAG interface standard, and each producer component must implement in accordance with what they want. Therefore, you first need to search for information on the implementation of JTAG that is used by producer for embedded devices that will be the target of reverse engineering.

Protocols and interfaces described above are only part of the protocol contained on embedded devices. There are still many other protocols and interfaces that you can learn, such as Inter Integrated Circuit Sound (I 2 S) that is used for audio signals, Serial Wire Debug (SWD) is a protocol developed by ARM, Spy-Bi-Wire (SBW) developed by Texas Instruments, Camera Serial Interface (CSI) Digital Serial Interface (DSI) developed by the MIPI Alliance, CANBUS which is mostly used in vehicles, Low Voltage Differential Signalling (LVDS) are typically used on the LCD display, for example, and others.

Before performing reverse embedded, we must know first the information chip that is used by that embedded. Here is information from some of the chips that are used by broadcasters’ livestream along with their respective functions:

When livestream broadcaster is active, it will automatically attempt to connect to the internet. Users’ livestream broadcaster was given several options for connection, which uses Ethernet, WiFi or USB modem. Users also can set the IP address of the device manually if they do not want to use DHCP. After connecting to the server livestream, the device will display the URL livestream broadcaster that should be accessed by the user to enter a PIN displayed on the device screen livestream broadcaster. In addition, the device also livestream broadcaster there are 2 open TCP port is port 22 and port 8080, as can be seen in pieces using nmap scan results the following:

After finding the Tx and Rx pin on the device livestream broadcaster, then we can connect to a computer using a serial adapter. For this article, we used the bus pirate v3.6. Because the location of the pins on the device livestream broadcaster is sufficiently tight, and difficult to reach by the connector hook, we used additional cables. There is a difference when a serial connection with the livestream broadcaster which LCD panels are being installed and when the LCD panel is not attached.

When the LCD panel is being installed, the input is entered to stop the boot process will only make the livestream broadcaster reboot. Whereas if the LCD panel is not attached. So the boot process will run using verbose function before we finally encounter an error. The message that appears when an error occurs shows much information about the device livestream broadcaster. Here is a snippet error messages that provide information regarding the location of the program counter (PC) when an error

No Reverse Engineering. Licensee shall not, directly or indirectly, reverse engineer or aid or assist in the reverse engineering of all or any part of Xbox Live or any associated hardware and software except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation. In the event applicable law grants Licensee the right to reverse engineer the Xbox notwithstanding this limitation, Licensee shall provide Microsoft with written notice prior to such reverse engineering activity, information sufficient regarding Licensee"s intended method of reverse engineering, its purpose and the legal authority for such activity and shall afford Microsoft a reasonable period of time before initiating such activity in order to evaluate the activity and/or challenge the reverse engineering activity with the appropriate legal authorities. Licensee shall refrain from such reverse engineering activity until such time as any legal challenge is resolved in Licensee"s favor. Reverse engineering includes, without limitation, decompiling, disassembly, sniffing, peeling semiconductor components, or otherwise deriving source code.

So this originally worked only wireless? Something sent information over IR and it displayed. You can likely eventually reverse engineer it but in the end you will need either an FPGA/CPLD or a full LCD segment driver to control the bare LCD. I don"t think it would be worth it to me. You can buy fully documented LCDs pretty cheap.