0

When protecting a device from being accessed via JTAG there are a number of ways to do it.

The two that come immediately to mind are:

  1. a 'fuse' that is blown;
  2. a JTAG 'password'.

What are some methods or equipment that are used to bypass these protections?

4

The question is kinda vague but here's some approaches that might work:

  1. Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value of the fuse, or change in the code flow in case the check is implemented in software. For an example of this technique see Breaking Code Read Protection on the NXP LPC-family Microcontrollers by Chris Gerlinsky (recon BRX 2017).

  2. Timing/side-channel attacks in case the checks are not specifically hardened against it. A very nice presentation using this technique was shown at Recon BRX 2018(Hacking Toshiba Laptops by Michał Kowalczyk and Serge Bazanski)

  3. Hardware attack (decapping the chip and changing the fuse value by direct micoprobing on the chip subtsrate, or just hooking into the core JTAG signals). This is rather complicated and needs a big investment of time and money but some code readout protections have been broken this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.