Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
When protecting a device from being accessed via JTAG there are a number of ways to do it.
The two that come immediately to mind are:
What are some methods or equipment that are used to bypass these protections?
The question is kinda vague but here's some approaches that might work:
Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value of the fuse, or change in the code flow in case the check is implemented in software. For an example of this technique see Breaking Code Read Protection on the NXP LPC-family Microcontrollers by Chris Gerlinsky (recon BRX 2017).
Timing/side-channel attacks in case the checks are not specifically hardened against it. A very nice presentation using this technique was shown at Recon BRX 2018(Hacking Toshiba Laptops by Michał Kowalczyk and Serge Bazanski)
Hardware attack (decapping the chip and changing the fuse value by direct micoprobing on the chip subtsrate, or just hooking into the core JTAG signals). This is rather complicated and needs a big investment of time and money but some code readout protections have been broken this way.
