Beyond Simple Software Debugging
summary
OpenOCD scripts and a logic analyzer find and manipulate boundary‑scan bits to do more than CPU debugging: a repo of scripts proves toggling an LED on an STM32 via boundary‑scan works by flipping bit 142, after mapping pins from a BSDL or reconstructed description; some devices expose JTAG for only about 8 ms after power‑on so a remote power supply and timed sequences are needed; PIC32 shows partial success, while i.MX6 trips the CPU into reset; tools used: OpenOCD, telnet, BSDL, IDA Pro/radare2 and custom scripts.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:53The target group
- 1:43Why I use OpenOCD?
- 2:34My reverse engineering rules
- 3:43Short investigation: History of JTAG
- 4:16boundary scan
- 6:02BSDL Example 1
- 8:43The road map
- 9:40Exploring JTAG port (time frames)
- 9:52Exploring JTAG port (Allwinner JTAG/SD)
- 13:41Exploring JTAG port (Open Sesame)
- 14:40Exploring the internals
- 15:58Find the right TAP
- 16:48Find the right Instruction
- 17:45Find the right Bits
- 18:29Exploring JTAG port (BS on STM32)
- 21:57Exploring JTAG port (GPIO + BS on STM32)
- 24:40Exploring JTAG port (GPIO + BS on PIC32)
- 25:45Exploring JTAG port (GPIO + BS on IMX6)
- 26:43Exploring JTAG on iMX6
related talks
32mSecSi Product Development
01h 46mTutorial: Introduction to Reverse Engineering
49mOpen Source Tools of the Hardware Hacking Trade
45mIntegrated Circuit Offensive Security
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
03mCODE BLUE 2016 contests
21mGlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers