I need advice on how to JTag a Microsoft Band

Question

I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a Microsoft band stores. To do this I need to get a data dump from the "Band". As the band has no usb connectivity. The only way I can think of this is to JTag the motherboard. I am not very experienced when it comes to Jtagging and as part of my research I have to find out how to do this. The facilities are all there in the university so that isn't a problem.

There has been very little research and the Microsoft band in terms of Forensic Analysis. So I was wondering whether anyone here knows their way around the band or JTagging in general.

A picture of the motherboard and chip are available from the this link https://www.sparkfun.com/news/1681 or https://cdn.sparkfun.com/r/500-500/assets/home_page_posts/1/6/8/1/Microsoft_Band_Teardown-33.jpg Any help would be largely appreciated.

Answer 1

You have picked a particularly hard target to try and find JTAG on, if this is your first project.

There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so you can't trace the pins from there. Same with the flash. It is almost certainly a multi-layer board as well.

So there are a number of options:

1. It may never have used JTAG. Very small and light devices sometimes have the processors programmed off-board, or simply have a basic bootloader that can communicate using normal channels.

2. The multi-way connectors may have been used for JTAG - the smaller one on lower right looks JTAG sized. However, those types of connectors are often rated for <100 insertion cycles, so JTAG would be uncommon on these.

3. There are a lot of test points. JTAG could be on these, but you would really need something like the JTAGulator to find it.

4. Sometimes, light boards have a snap-off connector used for initial programming.

I would attack this from a broader perspective. Personally I would try and desolder the flash, reball it and then read it. This is not trivial either.

Answer 2

First, you will need to make a map of every pins on the PCB, you will find a good starter here.

Once done, what I propose is to use a JTAG discovery tool. You can find some like this one or this one . It just need an Arduino and cables.

These tools are usefull to find JTAG pinout, but be careful to use a 5V to 3.3V adaptor as most JTAG are 3.3V compliant, use logic level shifter.

To be frank when you release such hardware JTAG bus are fused, which means that they blow fuse to break the connectivity. History prove that Microsoft forget sometimes to fuse it (check XBOX360).

If you can share chips model numbers it would be great as we could find some SPI to use, for example with Bus Pirate.

BTW a back picture would be great.