Questions tagged [jtag]
JTAG, short for Joint Test Action Group, is a method used for boundary scanning. Possibly applications are hardware testing/debugging and firmware flashing, including debricking of hardware which ended up in a defunct state.
42
questions
33
votes
4
answers
34k
views
How do I identify and use JTAG?
I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
- 4,066
10
votes
2
answers
1k
views
Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control
I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
- 151
10
votes
1
answer
424
views
Breaking in and debugging an unknown Arduino program
Okay, so I've got an Arduino which has a sketch flashed to it (that I do not have source code for) which I'd like to reverse-engineer, and I've successfully dumped the flash and disassembled part of ...
- 1,026
10
votes
1
answer
2k
views
GDB via JTAG on ARM Hardware target without source code
Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.
Update: ...
- 101
7
votes
2
answers
3k
views
Flash Reading by JTAG
I'm trying to read the flash memory of a microcontroller MPC5606B from Motorola. I saw his pins and saw that it uses jtag to perform debug, so I'm trying to use it JTAG interface to read its flash ...
- 215
7
votes
1
answer
4k
views
Using MIPS EJTAG functionality in OpenOCD
I am trying to use the OpenOCD functionality of a BusBlaster to debug a MIPS target. However, it doesn't look as though my target MIPS chip is defined in the list of sample target chip configurations -...
- 1,026
5
votes
2
answers
4k
views
How do I extract the firmware from this bluetooth speaker board?
I have a bluetooth speaker. Infinity Fuze 100.
It's a good speaker.
But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, ...
- 143
5
votes
1
answer
2k
views
How to identify SWD (Serial Wire Debug) pinout?
When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer.
When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in ...
- 437
5
votes
0
answers
142
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
4
votes
0
answers
27
views
JTAG Version 2.0 or 2.1
I need to identify which device has JTAG Version 2.1 for TI TMS320DM8168CCYG4 (Digital Media Processor). What socket is recommended?
4
votes
1
answer
231
views
What is an "mpi register base"?
For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
- 41
3
votes
1
answer
919
views
Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?
I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it.
I am wondering if there are any emulators that ...
- 177
3
votes
1
answer
256
views
Dump Headunit Software
I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble.
Note: I have no specialized tools just a DMM and ...
- 31
3
votes
0
answers
61
views
Help required to figure out the JTAG or UART pins
I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help ...
2
votes
2
answers
273
views
I need advice on how to JTag a Microsoft Band
I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a ...
- 21
2
votes
2
answers
886
views
Call function in remote (OpenOCD) target from gdb
Is there any way to call a function on a remote target that's attached via JTAG? Currently I have OpenOCD hooked up to a target and I'm attached with gdb, and I know the address of the function I want ...
- 2,898
2
votes
0
answers
56
views
Greenpacket OH-735 onboard header
I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
- 21
2
votes
0
answers
151
views
MSP430 JTAG FUSE
I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with ...
2
votes
0
answers
341
views
Help identify missing component for jtag connection
I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector.
(See here)
I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU
When I follow the wires, TCK, ...
- 185
2
votes
0
answers
562
views
Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer
I am getting this output when I am issuing this command:
$ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg
Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44)
...
- 131
2
votes
0
answers
187
views
JTAG finding BS registers for IC's pins
On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes)
But looking at BSDL files there are actually more BS registers than pins.
So for the ...
- 121
1
vote
1
answer
1k
views
JTAG protection bypass
When protecting a device from being accessed via JTAG there are a number of ways to do it.
The two that come immediately to mind are:
a 'fuse' that is blown;
a JTAG 'password'.
What are some ...
- 437
1
vote
2
answers
2k
views
Using USB JTAG probe with ARM & MIPS
Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
- 203
1
vote
1
answer
956
views
Extracting Keyboard Firmware
I am trying to find out how to extract firmware from a Bluetooth keyboard, my understanding is that I would have to JTAG to retrieve the the firmware from the device is that correct? Also has anyone ...
- 11
1
vote
1
answer
2k
views
Finding JTAG/UART Connections
I need help identifying the UART or JTAG connections on this board.
I would like to dump the firmware using a pirate bus.
- 11
1
vote
1
answer
2k
views
How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format
Issuing some commands for the dumped firmware:
$ du -h fw.bin
4.0 M
$ file fw.bin
fw.bin: data
$ file -i fw.bin
fw.bin: application/octet-stream; charset=binary
$ binwalk fw.bin
-
$ enca -L none ...
- 131
1
vote
1
answer
103
views
Microchip ATSAME70Q21-CN unable to connect with JTAG or SWD
First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract ...
- 11
1
vote
1
answer
111
views
JTAG TCK on Intel X Scale (ArmV5) PXA270
Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?
I'm probing signals on pads around the CPU and got a waveform like:
But I don't know whether any of this data is JTAG, or ...
- 131
1
vote
1
answer
842
views
NAND flash programming over host MCU JTAG
We starting mass production of a custom device. It uses Chinese MCU LT1901. MCU core is arm926ej-s.
MCU boots from NAND flash. We are forced to program NAND flash before soldering on PCB.
I don't like ...
- 11
1
vote
0
answers
49
views
Finding JTAG/UART Connections on smart doorbell
Trying to dump firmware of this device. I can't find the UART/JTAG connections.
I've searched over it for awhile now; I feel like I must just be missing something.
- 11
1
vote
0
answers
74
views
Reading/writing flash ROM connected to OMAP L138 without JTAG
I have a product that uses an OMAP L138 with a flash rom. There are a couple different models of this product available, but they all share the same hardware with the only difference being the ...
- 141
1
vote
0
answers
424
views
WRT54GL firmware extraction via JTAG with OpenOCD and Raspberry Pi as interface. Can not dump because the device is not halted
Good day!
Sorry to come up with something very old. Since I am currently teaching myself hardware hacking, I wanted to use my old router for this. I soldered pins to the JTAG interface and connected ...
- 11
1
vote
0
answers
100
views
cheap BGA x-ray machine?
I want to look under a BGA chip and map JTAG pins to traces where I can attach a JTAGulator. Is there some version of a BGA x-ray that isn't thousands of $'s?
Here's a picture of the BGA's. Would it ...
- 131
1
vote
0
answers
194
views
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:
but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
- 131
1
vote
0
answers
110
views
Finding the function of test points on a router
I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does ...
- 11
1
vote
0
answers
1k
views
Trying to dump firmware from embedded flash
I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
- 11
1
vote
0
answers
333
views
OpenOCD, Buspirate JTAG reads fail after short time
I have a board that I'm reversing - and attempting to dump the image out of the NAND flash.
Board has a SAMSUNG s3c2440 SOC CPU, and there's a SAMSUNG k9f1g08u0d 128 MB NAND flash device.
I'm using ...
- 11
0
votes
1
answer
369
views
How can I differentiate the JTAG pins like TMS, TDI, TDO, & TCK using impedance
How can I differentiate between the JTAG pins like TMS, TDI, TDO, & TCK using impedance?
Because when we connect JTAG (RS422) with unnamed pin, we got a problem. So I am asking how to identify ...
0
votes
1
answer
198
views
Writing data flash of MPC5606B through JTAG interface using Nexus
I'm programming flash memory of MPC5606B through JTAG interface using Nexus. I'm imitating a tool that perform this task. However, in the middle of the process, the entire flash memory is erased. I ...
- 215
0
votes
1
answer
211
views
Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)
Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like.
Device: For example modern ARM or PPC, or MIPS micros. Assuming you can ...
0
votes
1
answer
575
views
Flash reading by JTAG in MPC5606B
I'm using MPC5606B and I would like to know what kind of issues I would have, concerning protection\encryption if I tried to read its flash content by JTAG using an external device.
I was able to ...
- 215
0
votes
0
answers
28
views
Cloning full content of a pic24fj128gc010 chip (Flash + RAM)
I have some hardware that uses a PIC24fj128gc010 microcontroller. This microcontroller lives on a pluggable board that is plugged in on a main board. This detachable board has the microcontroller with ...
- 21