Retrofit integration
Electronics integrated into vehicles that were not originally equipped with them, communicating over the vehicle's own CAN and LIN networks rather than operating alongside them with a separate display and switch.
Services
Automotive systems and hardware reverse engineering
We develop against production vehicle equipment over CAN and LIN, integrate electronics into vehicles that were not originally equipped with them, and recover schematics and firmware from hardware supplied without documentation.
Service areas
Three types of project
They share a bench and a set of instruments, and they frequently occur together. A retrofit requires a bus to be decoded, and decoding a bus requires a rig to decode it on.
Reverse engineering
A board is supplied; a schematic and working firmware are delivered. Used when the original supplier is unavailable, source code was never transferred, or a component is end-of-life and the product is not.
Bench and test systems
Vehicle equipment operated outside the vehicle so that it can be tested, demonstrated or integrated into a simulator. P1LOT One originated as a project of this type.
Method
Hardware recovery process
Four stages, performed in this order, because each one establishes whether the next is worth commissioning. A proportion of boards stop at stage two with a documented conclusion that recovery is not economic.
Board analysis
Both sides are scanned and components identified from their package markings. Components with the markings removed are identified from their connectivity.
Schematic recovery
Connectivity is traced net by net and captured in CAD, then verified back against the physical board until the two agree.
Firmware analysis
Flash is read out where it is accessible and disassembled in Ghidra where it is not. Behaviour is verified against actual bus traffic.
Replacement firmware
New firmware for the recovered design, developed to be functionally compatible with the original, on a board that can now be manufactured again.
Examples
Hardware recovery projects
Electric scooter battery management
Automotive · MobilityA battery management board supplied with no documentation and no source. We traced the schematic back off the finished hardware, identified the parts whose markings had been removed from what they were wired to, and developed firmware that behaves like the original on the reconstructed design.
STM32G030 · schematic recovery · Ghidra · custom BMS firmware
Rental bike GSM and GPS lock
Mobility · IoTA lock for a rental bike fleet, rebuilt from a board that arrived without source code. We recovered the design, wrote replacement firmware for it, and connected it over GSM to a back end so units could be located and released remotely.
STM32F103 · GSM · GPS and NMEA · TCP/UDP sockets
Scope
Limits of this work
Reverse engineering is standard engineering practice and is also easily misread. The limits below are fixed, they are stated so that the scope is unambiguous, and they are the reason this page can be published at all.
Bench and off-road, until certified
This work is intended for test systems, simulators, prototypes and off-road vehicles. It is not offered for use on public roads, and it does not extend to certified safety systems including braking, airbags or steering.
That limit is certification rather than capability. Road and safety-critical work needs approvals we do not hold today, and it stays outside our scope until we do.
No records or emissions work
We do not modify odometer readings, service history or emissions behaviour, and we decline these requests when they are received.
Hardware you are entitled to modify
Work is performed on hardware you own or are authorised to modify. Manufacturer and model names appear anywhere on this site only to identify which equipment is compatible. No affiliation or endorsement is claimed or implied.
Send photographs of the board
Both sides, in focus, with the connector visible. That is normally sufficient to assess whether recovery is feasible, what it would involve, and whether it is economic.