I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does not seem to be available. The device is supposed to run linux and ecos for different functions. The bootloader prompt shows some options, also for reading memory so I could probably dump it from there. I need to take a closer look at how this could work though. There is no obvious JTAG header.
Anyways, there are multiple small solder blobs labeled TP (test point I guess).
I was wondering what would be the best approach to deduce their function and which tools I would need. What could be common functions beyond jtag? How are the individual components generally labeled? When I have TP 1 and 5, do I automatically have also TP 2,3,4 (maybe unlabeled) somewhere? Or are all components grouped together so that I might have C3,R4,SW5 instead?
Are pins which belong to the same function also usually grouped together on the PCB and are their traces/pins on the CPU next to each other? This seems to be at least the case for UART,RAM, USB.
I could maybe exclude some obvious things which are not JTAG like all the traces going from the CPU to other components like RAM, flash ... There are still lots of other traces which end in unlabeled enameled vias on the PCB.
What I have for the device specifically:
TP 1,3,4 have 3.3 V, TP2 has 0.2 V. They are close to each other and directly under the CPU.
TP282, 8 and 583 are also under the CPU and have 3.3V, 0V and 0.2V.
TP 205,206 and 207,208 are more close to the RAM but don't seem to be connected. They all have 0.2V They are also close to each other but on different sides of the PCB.
TP 6 and 7 have 3.3 V and are close to each other.
There is also a lonely TP 2407 with 3.3V
None of those has anything else connected to it, they come directly from the CPU. I was reading though, that JTAG is usually accompanied by resistors which would exclude JTAG for those TPs ? I don't know if a CPU can also have those internally.
