Reverse engineering printed circuit boards is generally regarded as a time-intensive and sometimes difficult process as the interconnect often vanishes beneath the surface of the board only to return to the surface at locations inaccessible to the tip of a continuity check. With marginal investment (and with the appropriate certifications) a dental-class X-ray sensor with a dental-class X-ray source can significantly reduce the time to decipher PCB interconnectivity. In this blog post, we delve into how this method can be extended beyond basic X-ray imaging and explore the potential of using this setup for a budget-friendly version of 3D X-ray tomography, accelerating the time to full reversal.
In comparison to past decades, X-ray setups no longer require a significant financial investment. With dental offices opening and closing, the availability of X-ray sources on the used marketplaces (for example, Craigslist) is common, and a complete X-ray setup can be purchased for less than $1000, including the imagery software. A variety of safeguards ensure the safe operation of the machine in a standard lab environment. These include protective casing on portable and hand-held units, the use of lead aprons and shields during X-ray procedures, and adherence to radiation safety guidelines. These units are specifically designed to be easily transported into a dental office for patient convenience and safety.
Below is an example of a complete setup available for purchase on eBay for $642.39 (plus tax) that includes both the X-ray source as well as the sensor and software:

Armed with these materials, we can go after the real cavities of the reversing world: unknown printed circuit board interconnect. Our first take on the dental software (this one is called “XVSensor”) is that it is designed for dentists who really only understand teeth. The software is easy to use and understand for the most part. The interface presents picture slots for all the teeth:

After a capture is made, the program indexes to the next tooth and is ready for another read. The detail with the budget sensor is pretty impressive for its price:

This level of detail immediately provides incredibly useful information to someone trying to understand the connectivity of the target. The sensor is situated right behind the circuit board and it targets a relatively small area of about 1.5″ x 1″. Therefore, to achieve larger plan views of the board, a tiled acquisition approach must be implemented.
The result in this example is a set of two images of a Bluetooth serial converter. While they look identical, there is a slightly different look angle. If you place them side by side and cross your eyes such that they overlap, you will register a 3D stereoscopic image. Go ahead. Cross those eyes!


The resulting information allows you to discern things like top and bottom board components and traces. It enables you to follow traces from the bottom of the board, through a via (a type of PCB electrical conduit), and to the top of the board (or to an inner metal layer).
This new representation of the X-ray images ultimately allows us a better and faster understanding of board interconnect. With a quick setup time, obtaining X-rays is simple, efficient, and illuminating! Enjoy these examples, and don’t forget to cross your eyes!






Can you resolve the Bluetooth antenna beneath the primary circuit board?




Mostly metal.






Note inner-layer high-speed signal routing.






Note that even with an extreme look-angle, a stereo image is difficult to resolve because the card is so thin.






No joke! This YouTube video shows the dissection of this particular SDCard—it really is just a small board in a large plastic case.


TPM packet dissection and analysis in Wireshark using open source scripts and projects with a practical walkthrough using Proxmox.
Can prompt injections hidden in unreachable code still influence LLM's?
Everything you need to know about Offensive Cyberspace Operations and the OCO/CNO resources Zetier cyber engineers rely on.
Keeping the Monsters at Bay with Embedded Systems Digital Forensics
2025 was a successful year for Zetier, with office growth, more "sheeping" unguarded colleague workstations, and fun diet(ary) choices
A case study in identifying real-world stack overflows in Netgear router firmware – without access to source code.
Are low-cost SBCs with 4k output viable for native development, RE, and tinkering?
See what your BDM debugger is actually doing under the hood with our new open-source tool.
You just fired up an old Linux-based appliance. Here's one hacking recipe to get beyond basic local access.
Understand the mechanics, risks, and future of IMSI catching (a.k.a. stealing your cellular ID) in 2025.
Thousands of video game enthusiasts are developing experience in the cybersecurity industry by accident.
One of our engineers obtained free printers on Craigslist, which revealed some intriguing obfuscation.
After competing for several years, a Zetier Cyber Engineer made the podium at the DEFCON 32 HHV CTF.
Check out the contributions our team made – and tools we open-sourced – in 2024.
Frida runs out-of-the-box on many common targets. How hard is it to port Frida to an unsupported platform?
When code is executed with Bungeegum, it operates within the application's context and memory space, mirroring how Android CNO tools are typically used in real-world scenarios.
A recently acquired piece of military technology holds secrets about worldwide manufacturing capabilities.
Thousands of military members juggle their reserve commitment and civilian life. Read this post to learn how Zetier makes sure you won’t drop the ball.
Building tshark from source with support for Lua has proven to be a challenge. This tutorial will save you some time and frustration.
Hardware memory busses are sometimes tied together with multiple ICs. Here is how to SMASH them!
Breadcrumbs are left throughout computer systems that hackers can use to track attribution or recover sensitive information. See possible gotchas in this post.
Various topics of interest covering IT, cybersecurity, tech innovations, from GitLab workflows to satellite tech advancements.
Zetier is introducing Snipey, a command-line interface (CLI) tool that extends the capabilities of Snipe-IT.
Highlights from around the internet that we discussed in the office during Dec 2023. Everything from the best deals on collectable turbo-jet engines to Bluetooth CVEs.
Explore the art of using JTAG for efficient NOR flash memory dumps – via our practical guide for hardware enthusiasts & engineers.
Lariat works with Device Farmer to address the challenges of platform fragmentation in Android device testing.
Sharing knowledge is in Zetier’s corporate DNA, and this expresses itself in multiple ways.
Smart load integration with inexpensive power supplies providing protections typically found only in pricier models.
At Zetier’s 2023 annual offsite we met in San Juan Puerto Rico for some corporate business, relationship building, good food, and fun in the sun.
CodeQL is a query language for code analysis, allowing powerful code introspection and data flow queries.
Subscribe now to keep reading and get access to the full archive.