| 02:04.12 | *** join/#openjtag purl (ibot@rikers.org) |
| 02:04.12 | *** topic/#openjtag is this is the place to discuss bootloaders and JTAG |
| 02:39.15 | *** join/#openjtag _julian_ (~quassel@dslc-082-083-132-217.pools.arcor-ip.net) |
| 06:27.01 | *** join/#openjtag Weaselweb (~quassel@2001:6f8:9e4:123:21a:92ff:fe5a:1409) |
| 18:03.19 | *** join/#openjtag hackish (~adb14c4c@gateway/web/freenode/x-ntjahxhooammtcud) |
| 18:04.15 | hackish | How common is it to be able to read or write the contents of a processor via jtag? |
| 18:04.42 | hackish | I've been looking at commercial tools and they cost like $10k easily. |
| 18:05.04 | hackish | Basically I have a processor on an embedded controller and I want to read the firmware off it's onboard flash. |
| 18:05.13 | hackish | Any ideas? |
| 18:22.37 | roxfan | there are plenty of cheap dongles |
| 18:22.45 | roxfan | ftdi based and such |
| 18:23.02 | roxfan | or even a five-resistor lpt wiggler |
| 18:23.19 | roxfan | but you need to know the jtag pins on the board |
| 18:44.46 | hackish | jtag pins on the board are easy |
| 18:46.13 | hackish | Trouble so far has been finding any info on it. I have the data sheets for the processor and they show boundary scan and somthing called tap. |
| 18:46.49 | roxfan | tap means test access point |
| 18:47.08 | roxfan | basically the thing that handles jtag communication |
| 18:47.40 | hackish | ah. My problem is you don't find anyone talking about reading/writing the device memory or flash via jtag |
| 18:48.04 | roxfan | well, there are two ways |
| 18:48.15 | roxfan | 1) boundary scan (used by urjtag) |
| 18:48.40 | roxfan | you just sort of ignore the cpu and use boundary scan register to toggle pins connected to the flash |
| 18:49.02 | roxfan | pretty slow and you need to know the BSR layout |
| 18:49.11 | gronsaken | is that possible with an internal flash? |
| 18:49.17 | hackish | the flash I'm thinking of is internal to the processor |
| 18:49.19 | roxfan | ah, internal |
| 18:49.21 | roxfan | hmm |
| 18:49.35 | roxfan | well, then second approach might work |
| 18:49.48 | roxfan | 2) ask cpu to read data (used by openocd) |
| 18:50.18 | roxfan | use jtag to write a read instruction to the instruction cache, execute it, read the filled in cpu register |
| 18:50.32 | roxfan | needs support from the cpu for such stuff |
| 18:51.11 | roxfan | btw many mcus with embedded flash have a serial bootloader for initial programming' |
| 18:52.18 | roxfan | and sometimes it allows reading, not just writing |
| 18:52.18 | hackish | This has a serial bootloader but my challenge is to get the flash out because the serial bootloader requires a password. |
| 18:52.24 | roxfan | ah |
| 18:52.30 | hackish | I know it's possible because others have somehow read it. I assume through the jtag port. |
| 18:52.44 | gronsaken | which mcu is it? |
| 18:52.50 | hackish | m32r |
| 18:52.51 | roxfan | read the docs, see if there are extra jtag commands |
| 18:53.11 | hackish | the docs don't talk about any extra commands |
| 18:53.33 | hackish | I suspect they'd be undocumented. |
| 18:54.26 | roxfan | iirc urjtag can discover extra commands |
| 18:54.35 | roxfan | or try this http://deadhacker.com/2010/02/03/jtag-enumeration/ |
| 18:56.31 | roxfan | hmm http://www.activeboard.com/forum.spark?aBID=99460&p=3&topicID=25151801&page=1 |
| 18:57.10 | hackish | Ok. I will read the jtag-enumeration stuff. I don't mind reading docs - have done a lot of that but sometimes it's easier to find out if I'm wasting my time at the outset. |
| 18:57.50 | hackish | yes the activeboard stuff. At some point he says he read it via the debug port. |
| 18:58.06 | roxfan | i wonder if that UFLA32R has a password inside |
| 18:58.43 | hackish | nope. It doesn't have the pwd inside. |
| 18:59.13 | hackish | Once you discover the password it's the same for most ECUs |
| 19:01.24 | roxfan | hmm i see something called "Real-Time Debugger (RTD)" in the datasheet |
| 19:02.58 | hackish | yes there is also the RTD. I was thinking if I kick the chip into bootloader mode possibly the RTD could be used to read all the RAM and I may find the bootloader password has been loaded into ram. |
| 19:04.08 | hackish | If a programmer had security in mind they'd disable the RTD the second the bootloader starts... however in my experience these guys seldom have security at the top of their list. |
| 19:04.22 | roxfan | can it be disabled? |
| 19:05.54 | roxfan | btw i don't see any limits for "read ram" command mentioned... so maybe it can access flash as well |
| 19:06.06 | hackish | never thought about that. |
| 19:06.30 | hackish | I assume it can be disabled but have never tried that... |
| 19:06.49 | hackish | I haven't yet worked out how to read/write stuff on the RTD port. |
| 19:07.11 | hackish | a simple USB serial converter seemed like a good idea but it also requires a clock signal. |
| 19:08.21 | roxfan | ftdi chips seem to provide a pretty flexible way to work with many synchronous protocols |
| 19:08.30 | roxfan | but i'd just use some microcontroller |
| 19:10.07 | roxfan | it looks pretty close to spi |
| 19:41.14 | *** join/#openjtag toi (~toi@195.177.247.4) |
| 19:56.27 | hackish | I suppose I could get a micro to bit-bang the protocol but man, I hate writing stuff like that if there is a way to do it otherwise. |
| 20:08.13 | roxfan | well, you could ask that guy :) |
| 20:09.17 | hackish | Tried contacting him. No go on that. These guys usually don't like to let any info out. |
| 20:29.03 | roxfan | gotta do it yourself then |
| 23:53.24 | *** join/#openjtag purl (ibot@rikers.org) |
| 23:53.24 | *** topic/#openjtag is this is the place to discuss bootloaders and JTAG |
| 23:54.22 | *** join/#openjtag dieter|work (~dieter@dslb-088-065-196-239.pools.arcor-ip.net) |