Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jtag]

JTAG, short for Joint Test Action Group, is a method used for boundary scanning. Possibly applications are hardware testing/debugging and firmware flashing, including debricking of hardware which ended up in a defunct state.

1
vote
1answer
95 views

Is there any JTAG or UART port on the NES Classic?

Attached teardown of the NES Classic The CPU (Allwinner R16 aka A33) has 5 UART ports.
0
votes
1answer
160 views

JTAG protection bypass

When protecting a device from being accessed via JTAG there are a number of ways to do it. The two that come immediately to mind are: a 'fuse' that is blown; a JTAG 'password'. What are some ...
5
votes
1answer
286 views

How to identify SWD (Serial Wire Debug) pinout?

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer. When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
0
votes
1answer
350 views

Finding JTAG/UART Connections

I need help identifying the UART or JTAG connections on this board. I would like to dump the firmware using a pirate bus.
0
votes
1answer
57 views

Writing data flash of MPC5606B through JTAG interface using Nexus

I'm programming flash memory of MPC5606B through JTAG interface using Nexus. I'm imitating a tool that perform this task. However, in the middle of the process, the entire flash memory is erased. I ...
1
vote
1answer
331 views

Extracting Keyboard Firmware

I am trying to find out how to extract firmware from a Bluetooth keyboard, my understanding is that I would have to JTAG to retrieve the the firmware from the device is that correct? Also has anyone ...
0
votes
1answer
50 views

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like. Device: For example modern ARM or PPC, or MIPS micros. Assuming you can ...
0
votes
1answer
206 views

Flash reading by JTAG in MPC5606B

I'm using MPC5606B and I would like to know what kind of issues I would have, concerning protection\encryption if I tried to read its flash content by JTAG using an external device. I was able to ...
6
votes
2answers
955 views

Flash Reading by JTAG

I'm trying to read the flash memory of a microcontroller MPC5606B from Motorola. I saw his pins and saw that it uses jtag to perform debug, so I'm trying to use it JTAG interface to read its flash ...
-1
votes
0answers
114 views

Numark NDX400 firmware modifying (DSP code)

The Numark NDX400 is quite a good player if you only look it for a short time: has CD and USB support, good button layout, decent sound and build quality. But as you use it more, the shortcomings are ...
1
vote
0answers
68 views

MSP430 JTAG FUSE

I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with ...
0
votes
0answers
149 views

JTAG pinout for Linksys E4200v2/EA4500

Can anyone specify an actual JTAG pinout for Linksys E4200v2/EA4500 router? The EA4500 and the EA4200v2 are actually identical hardware. There is unpopulated 8-pin JTAG header on PCB, 4x2 rows. s10....
1
vote
1answer
576 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
2
votes
0answers
104 views

Help identify missing componant for jtag connection

I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector. (See http://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnections) I think it's JTAG because PIN#3 and 5 ...
2
votes
0answers
235 views

Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer

I am getting this output when I am issuing this command: $ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44) ...
1
vote
0answers
620 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
-1
votes
0answers
133 views

Identifying JTAG pins of a cpu

I am having trouble identifying this chip's jtag pins. it says it is an STM32L152 chip, but a google check did not show up any relevant result. What's more, is there a relatively easy method to access ...
2
votes
2answers
383 views

Call function in remote (OpenOCD) target from gdb

Is there any way to call a function on a remote target that's attached via JTAG? Currently I have OpenOCD hooked up to a target and I'm attached with gdb, and I know the address of the function I want ...
2
votes
2answers
209 views

I need advice on how to JTag a Microsoft Band

I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a ...
2
votes
1answer
545 views

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it. I am wondering if there are any emulators that ...
2
votes
0answers
132 views

JTAG finding BS registers for IC's pins

On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes) But looking at BSDL files there are actually more BS registers than pins. So for the ...
0
votes
0answers
247 views

OpenOCD, Buspirate JTAG reads fail after short time

I have a board that I'm reversing - and attempting to dump the image out of the NAND flash. Board has a SAMSUNG s3c2440 SOC CPU, and there's a SAMSUNG k9f1g08u0d 128 MB NAND flash device. I'm using ...
2
votes
2answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
10
votes
1answer
298 views

Breaking in and debugging an unknown Arduino program

Okay, so I've got an Arduino which has a sketch flashed to it (that I do not have source code for) which I'd like to reverse-engineer, and I've successfully dumped the flash and disassembled part of ...
8
votes
0answers
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
9
votes
2answers
910 views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
6
votes
1answer
3k views

Using MIPS EJTAG functionality in OpenOCD

I am trying to use the OpenOCD functionality of a BusBlaster to debug a MIPS target. However, it doesn't look as though my target MIPS chip is defined in the list of sample target chip configurations -...
27
votes
4answers
23k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...