Hot answers tagged

6 votes
Accepted

Flash Reading by JTAG

Interpreting JTAG transactions by hand can be pretty tiresome. If you can export your data to a more or less universal data format, like VCD or even a CSV file, you can use Sigrok and Pulseview to ...
user avatar
5 votes
Accepted

JTAG protection bypass

The question is kinda vague but here's some approaches that might work: Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value ...
user avatar
  • 34.9k
5 votes

Flash Reading by JTAG

Your interpretation looks pretty close to me. However, this is very low-level view, you need to bring it back to the higher level, at least IR/DR. For example, the whole exchange 1-3 can be summarized ...
user avatar
  • 34.9k
4 votes

I need advice on how to JTag a Microsoft Band

You have picked a particularly hard target to try and find JTAG on, if this is your first project. There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so ...
user avatar
  • 1,672
4 votes

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for ...
user avatar
4 votes
Accepted

How do I extract the firmware from this bluetooth speaker board?

Based on a datasheet found on Internet (http://www.lanzhi-tech.com/filedownload/99240) it seems that the ATS2815 is a chip that has everything to manage a Bluetooth speaker and, probably, it is inside ...
user avatar
3 votes

How do I extract the firmware from this bluetooth speaker board?

You may be right that the firmware is stored on the xt25f08b chip. It's not uncommon for firmware to be stored on a flash chip like that, and I don't see any other storage. One fairly simple way is to ...
user avatar
3 votes

Breaking in and debugging an unknown Arduino program

I'm not familiar with that tool, so I don't have an answer for your specific question. But here are two pieces of advice: 1) there are many arduino simulators that you can use to single-step thru ...
3 votes

Extracting Keyboard Firmware

JTAG is one way, if you manage to find it on the board and figure out how to dump the firmware over it. However, there are often easier ways, e.g. if the firmware is in a separate flash chip, dump it ...
user avatar
  • 34.9k
2 votes

Using USB JTAG probe with ARM & MIPS

I have used the following devices successfully with OpenOCD: https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD/ (only ARM) http://amontec.axianet.ch/jtagkey/jtagkey (multi-architecture) The Bus ...
user avatar
2 votes

Using USB JTAG probe with ARM & MIPS

Have you seen the Bus Blaster? It is an FT2232 based board which has both ARM and MIPS eJTAG support. The Bus Pirate (also sold by Dangerous Prototypes) also has the ability to perform JTAG, but it ...
user avatar
2 votes

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like: file busybox busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1. My guess is ...
user avatar
2 votes

Finding JTAG/UART Connections

In the second picture on the bottom there is an nonpupulated connector, whose pins are labeled RX and TX. Thats at least one of maybe more uart interfaces. You should additionaly check the traces on ...
user avatar
2 votes

I need advice on how to JTag a Microsoft Band

First, you will need to make a map of every pins on the PCB, you will find a good starter here. Once done, what I propose is to use a JTAG discovery tool. You can find some like this one or this one ....
user avatar
  • 161
1 vote

How can I differentiate the JTAG pins like TMS, TDI, TDO, & TCK using impedance

The impedance will vary depending on the model and manufacturer of the chip. There isn't much of a standard. More importantly, if the chip is on a PCB, the other components on the board will almost ...
user avatar
1 vote

Dump Headunit Software

Dumping the flash is probably the quickest way to start. You can then inspect the dump for any code, images, or data tables. If that fails you may have to dump the internal flash of the chips or try ...
user avatar
  • 34.9k
1 vote

JTAG TCK on Intel X Scale (ArmV5) PXA270

No, TCK doesn’t have to match the CPU clock. In fact its usual speed is in kilohertz, not megahertz. However, you likely won’t see it in the oscilloscope or logic analyzer because it is driven by the ...
user avatar
  • 34.9k
1 vote

NAND flash programming over host MCU JTAG

There are two possible ways of programming flash over JTAG in such a circuit: use JTAG boundary scan to directly bitbang flash chip pins connected to the CPU as if you connected programmer to it. ...
user avatar
  • 34.9k
1 vote

How to identify SWD (Serial Wire Debug) pinout?

Not aware of any similar software tools for SWD, but: If you can see or infer the chip part number, look at the data sheet. Look for test points (or connectors) that may be used in factory ...
user avatar
  • 55
1 vote

Writing data flash of MPC5606B through JTAG interface using Nexus

At a guess, it is using NAND flash. This type of flash has good density and is reasonably cheap but it has one limitation: individual bits can be only toggled from 1 to 0 but not the other way around. ...
user avatar
  • 34.9k
1 vote

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-...
user avatar
1 vote

Flash reading by JTAG in MPC5606B

After to study Chapter five of MPC5606's reference manual, I expected that the tool would send a 64-bits password, but I didn't found it in communication yet ( the time of communication is too big,...
user avatar
  • 34.9k
1 vote

GDB via JTAG on ARM Hardware target without source code

binnavi from google works well remotely with gdb, it does require a bit of setup though and also needs IDA to create the IDB which is then converted to navi database format. https://github.com/google/...
user avatar
1 vote
Accepted

Call function in remote (OpenOCD) target from gdb

This isn't the cleanest solution, and I still don't know how to make gdb do it properly. My solution was to simply manually "call" the function by: Save the current set of registers (info reg => log ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible