Reverse Engineering Services
PCB analysis. Schematic recovery. Chip-level reverse engineering. Engagements include PCB reverse engineering, IC analysis, and related work — all under NDA.
Overview
Hardware reverse engineering services covering PCB analysis, schematic recovery, and IC-level reverse engineering. NDA-protected engagements for legacy and proprietary hardware.
Engagements are scoped to a fixed deliverable list before kickoff and run under a written NDA. Daily lab notes and weekly written status keep the work auditable from your side at every step.
In the lab
Plan the layer stack-up, the imaging order, the chain-of-custody.
Hardware RE Lead
Anonymized pre-NDA
How we work
In both reverse engineering and custom development, we never thoughtlessly clone. We carry out improvements and adaptations to the customer's specific task, because the existing solution often cannot fully satisfy the customer's request. Reverse engineering surfaces the design intent; the engineering that follows decides what to keep, what to change, and what to engineer from scratch.
Engineering analysis
As part of both reverse engineering and custom development projects, we perform in-depth engineering analysis based on mathematical and physical modeling. Depending on project requirements this may include structural calculations, fluid dynamics, gas flow analysis, thermal processes, stress and load simulations, process modeling, and validation of engineering assumptions affecting system performance and operational reliability — used for design verification, technology assessment, process optimization, and validation of technical parameters for production and commercial deployment.
When you call us
Patterns we see across engagements. Each can stand alone or combine with adjacent capabilities.
Recover schematics, BOMs, and layout intent from boards whose original CAD files are lost. Critical for long-life industrial, defense, and medical platforms.
Produce clean, modern KiCad or Altium schematics from a physical board. Enables redesign, second-source qualification, and component substitution.
Decapsulation, layer imaging, and netlist recovery for integrated circuits when behavior cannot be inferred from external signals alone.
X-ray, decap, and electrical comparison against authentic samples to confirm whether parts in your supply are genuine.
Establish what a suspect board actually is and does — common in field-failure investigations and post-acquisition diligence.
Identify debug headers, unsecured flash, side-channel exposures, and tamper resistance. Outputs feed product hardening or coordinated disclosure.
Generate the schematics, BOMs, and assembly drawings your engineering team needs to keep an end-of-life product in production.
Methodology
Vertical phasing — each step's deliverables agreed before kickoff, and not closed until you sign off.
Phase 01
Mutual NDA executed before any sample, schematic, or technical materials change hands. Scope, deliverables, and chain-of-custody terms confirmed in writing.
Phase 02
Sample receipt, photo log, and chain-of-custody documentation. Decision on destructive vs. non-destructive scope and written engagement plan.
Phase 03
Optical scans, X-ray, and where required CT imaging. Produces an internal map before any layer is removed.
Phase 04
Controlled removal of solder masks and copper layers. Each layer imaged at high resolution before the next is removed.
Phase 05
Trace and pad mapping converted into a hierarchical schematic with signal-level annotations and a derived BOM.
Phase 06
Continuity checks against the physical board and behavioral comparison where the board is functional. Discrepancies flagged in writing.
Tooling
Named tools, in production. We don't list anything we don't actually use.
Tool
Saleae Logic analyzers
Production use — versioned per-engagement and pinned in our build.
Tool
Bus Pirate
Production use — versioned per-engagement and pinned in our build.
Tool
JTAGulator
Production use — versioned per-engagement and pinned in our build.
Tool
ChipWhisperer
Production use — versioned per-engagement and pinned in our build.
Tool
X-ray imaging stations
Production use — versioned per-engagement and pinned in our build.
Tool
Optical microscopy
Production use — versioned per-engagement and pinned in our build.
Tool
Phase 1 PCB scanners
Production use — versioned per-engagement and pinned in our build.
Tool
KiCad / Altium for schematic capture
Production use — versioned per-engagement and pinned in our build.
Tool
Decapsulation chemistry stack
Production use — versioned per-engagement and pinned in our build.
$ scan layer top --resolution 8000dpi --reflow off
Captured layer 1/6 · 240 traces resolved
$ ic-decap --site U7 --plasma --time 18m
Die surface clean · imaging at 50x
$
Deliverables
Artifacts handed over at close-out. Each is reproducible and self-contained.
Sample deliverable
hardware-reverse-engineering · final report
rev.04 · pdf
Engagement summary
Findings
Our practice
Hardware work happens at a physical bench. Optical and X-ray imaging, controlled delayering, electrical probing — every step is photo-logged for chain-of-custody.
Lab in practice
Layer-by-layer imaging, controlled decapsulation, signal-level probing — every step photo-logged.
Hardware RE Lead
Anonymized pre-NDA
Senior PCB Engineer
Anonymized pre-NDA
IC Analysis Lead
Anonymized pre-NDA
Metrology Engineer
Anonymized pre-NDA
“The board comes in. We image, we delayer, we recover the schematic — and your team gets a buildable package.”
Cross-industry
Sectors where this work is most often scoped. Cross-link to detailed industry pages for sector-specific context.
ECU, CAN, and aftermarket interoperability.
Hardware RE for automotiveSustainment for long-life platforms.
Hardware RE for aerospaceCompliance-aware reverse engineering.
Hardware RE for medical devicesFirmware extraction and protocol mapping.
Hardware RE for iot & embeddedPLC and legacy controller recovery.
Hardware RE for industrial & manufacturingQuestions
Pulled from real client conversations. If yours isn't here, ask directly.
Our hardware reverse engineering services cover printed circuit board analysis, schematic recovery, integrated circuit analysis, and chip-level reverse engineering. We work from physical samples and produce schematics, BOMs, layout files, and signal-level documentation that an engineering team can build from.
We start with optical and X-ray imaging to map the board non-destructively. Where the board is multi-layer we then remove layers one at a time, imaging each before the next is taken. Trace and via topology becomes a netlist, the netlist becomes a hierarchical schematic, and the schematic is verified against the physical board with continuity testing.
Yes. We perform decapsulation, optical and SEM imaging of die layers, and netlist extraction for integrated circuits. The depth of work depends on the question: identifying a counterfeit takes a fraction of the work that recovering a custom ASIC's logic does. Both fall within our hardware reverse engineering services.
Single-sample work is common. We bias toward non-destructive techniques first — imaging, electrical probing, JTAG and SWD where exposed — and only proceed to destructive analysis when the question requires it and you have authorized it in writing.
Counterfeit detection combines X-ray imaging, decapsulation, electrical comparison against authentic samples, and microscopy of die markings and bond patterns. The deliverable is a written assessment with photographic evidence, sufficient to support supply-chain action.
Yes — manufacturable output is the standard deliverable for our circuit board analysis engagements. We recover the schematic in hierarchical form, produce a BOM with current manufacturer part numbers and noted second sources, and provide PCB layout files in Gerber format. The output is buildable.
Single-board PCB recovery runs four to eight weeks. Multi-board systems and IC-level work run longer. We provide a fixed scope letter with milestones before any sample is destructively analyzed.
Samples arrive in tamper-evident packaging with prepaid return labels. We photo-log on receipt with serial-level annotation, maintain handler access logs, and either return or destroy samples per your written direction at engagement close. A destruction certificate is available on request.
Engagements start with a scoping phase under NDA. Project length and pricing depend on board complexity, layer count, IC custom-content depth, and required deliverable formats. We offer fixed-bid scopes for well-bounded projects and time-and-materials for exploratory IC work.
Selected work
Engagements where this pillar carried significant scope.
A gas–liquid peeling device engineered for cosmetic procedures: non-contact mechanical peeling, contouring massage, skin resurfacing, and related aesthetic treatments. Uses controlled gas–liquid stream as the treatment medium — no direct mechanical contact with the skin.
Read case studyDesigned two complete fused-filament 3D printers — a desktop platform at 300x300x300mm and a mid-format unit at 600x600x600mm — sharing a single kinematic class, electronics architecture, and firmware configuration so the client could field both SKUs with one parts catalog and one service workflow.
Read case studyDeveloped and produced a working prototype of an oxygen–helium therapy device — a heated, mixed-gas inhalation system used in pulmonology, cardiology, ophthalmology, sports and diving medicine, hypothermia treatment, and complex care for viral pneumonia including COVID-19. One device, a clinic-to-home form factor, the same indication set as fixed installations.
Read case studyMore from us
Adjacent capabilities you may need on the same engagement.
Reverse Engineering
Extract, analyze, and document embedded firmware.
Explore Firmware REReverse Engineering
3D scanning. CAD reconstruction. Physical part recreation.
Explore Mechanical REReverse Engineering
Vulnerability discovery. Code audits. Exploit research.
Explore Security ResearchEngage
All inquiries reviewed under NDA. We respond within two business days with a scoped engagement plan and fixed deliverables list.
Senior engineers · Anonymized pre-NDA
