I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins to but I think JTAG was probably disabled by the processor at boot, at least I can't get anything to connect. I am using a Black Flash USB programmer board and Blackcat software. The device has a RS232 port but I haven't been able to get anything out of it.

This might be better suited for EE but the TDI and TCK circuits have pull-up resistors on them, the TRST circuit has a pull-down resistor, and the TMS and TDO do not have any. I don't know if that's normal or not.

I don't think the memory chip can be read directly unless I have some kind of special clip (which probably won't fit this application) or it's desoldered? Desoldering is out of the question unfortunately. So that means I need to find some way to enable JTAG?

It can also run in "dead poll" mode by holding a button at boot in order to program the main firmware. As I understand it at that point the device is running on the boot block firmware. I'm not sure if that could help me or not. I also don't know if the boot block image is programmed into the internal SoC or to a special block on the flash chip. I have a copy of both the main firmware and boot block file but I'm sure they are encrypted/obfuscated. I have also reversed the programming software and sniffed the usb during firmware updates to confirm that the decryption isn't done in software.

According to the XC161CJ datasheet it looks like it can be run off internal or external memory, I don't know if that could help or if there is any risks from messing with it. Also maybe I could try to dump the internal SoC memory, but there could be security checks to prevent this? I guess I just really don't know where to go from here. I've done some JTAG programming before but always with a guide to follow. This is the first time I've had to figure it out for myself and I'm stuck.

Any help would be appreciated. Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.