Hot answers tagged

6 votes
Accepted

How do I extract the firmware from this bluetooth speaker board?

Based on a datasheet found on Internet (http://www.lanzhi-tech.com/filedownload/99240) it seems that the ATS2815 is a chip that has everything to manage a Bluetooth speaker and, probably, it is inside ...
Valerio Di Giampietro's user avatar
6 votes
Accepted

Flash Reading by JTAG

Interpreting JTAG transactions by hand can be pretty tiresome. If you can export your data to a more or less universal data format, like VCD or even a CSV file, you can use Sigrok and Pulseview to ...
Vladislav Ivanov's user avatar
5 votes

Flash Reading by JTAG

Your interpretation looks pretty close to me. However, this is very low-level view, you need to bring it back to the higher level, at least IR/DR. For example, the whole exchange 1-3 can be summarized ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

JTAG protection bypass

The question is kinda vague but here's some approaches that might work: Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value ...
Igor Skochinsky's user avatar
  • 36.5k
4 votes

How do I extract the firmware from this bluetooth speaker board?

You may be right that the firmware is stored on the xt25f08b chip. It's not uncommon for firmware to be stored on a flash chip like that, and I don't see any other storage. One fairly simple way is to ...
multithr3at3d's user avatar
3 votes

Extracting Keyboard Firmware

JTAG is one way, if you manage to find it on the board and figure out how to dump the firmware over it. However, there are often easier ways, e.g. if the firmware is in a separate flash chip, dump it ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like: file busybox busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1. My guess is ...
Brandon Bryant's user avatar
2 votes

Finding JTAG/UART Connections

In the second picture on the bottom there is an nonpupulated connector, whose pins are labeled RX and TX. Thats at least one of maybe more uart interfaces. You should additionaly check the traces on ...
user5626466's user avatar
1 vote

How can I differentiate the JTAG pins like TMS, TDI, TDO, & TCK using impedance

The impedance will vary depending on the model and manufacturer of the chip. There isn't much of a standard. More importantly, if the chip is on a PCB, the other components on the board will almost ...
KrzysisAverted's user avatar
1 vote

How to identify SWD (Serial Wire Debug) pinout?

Not aware of any similar software tools for SWD, but: If you can see or infer the chip part number, look at the data sheet. Look for test points (or connectors) that may be used in factory ...
esrever's user avatar
  • 55
1 vote

Dump Headunit Software

Dumping the flash is probably the quickest way to start. You can then inspect the dump for any code, images, or data tables. If that fails you may have to dump the internal flash of the chips or try ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

JTAG TCK on Intel X Scale (ArmV5) PXA270

No, TCK doesn’t have to match the CPU clock. In fact its usual speed is in kilohertz, not megahertz. However, you likely won’t see it in the oscilloscope or logic analyzer because it is driven by the ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

NAND flash programming over host MCU JTAG

There are two possible ways of programming flash over JTAG in such a circuit: use JTAG boundary scan to directly bitbang flash chip pins connected to the CPU as if you connected programmer to it. ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

Writing data flash of MPC5606B through JTAG interface using Nexus

At a guess, it is using NAND flash. This type of flash has good density and is reasonably cheap but it has one limitation: individual bits can be only toggled from 1 to 0 but not the other way around. ...
Igor Skochinsky's user avatar
  • 36.5k
1 vote

Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)

I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-...
Vladislav Ivanov's user avatar
1 vote

Flash reading by JTAG in MPC5606B

After to study Chapter five of MPC5606's reference manual, I expected that the tool would send a 64-bits password, but I didn't found it in communication yet ( the time of communication is too big,...
Igor Skochinsky's user avatar
  • 36.5k
1 vote
Accepted

Call function in remote (OpenOCD) target from gdb

This isn't the cleanest solution, and I still don't know how to make gdb do it properly. My solution was to simply manually "call" the function by: Save the current set of registers (info reg => log ...
Brendan Dolan-Gavitt's user avatar
1 vote

GDB via JTAG on ARM Hardware target without source code

binnavi from google works well remotely with gdb, it does require a bit of setup though and also needs IDA to create the IDB which is then converted to navi database format. https://github.com/google/...
1455J8KL's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible