-
Notifications
You must be signed in to change notification settings - Fork 92
HydraFW JTAG guide
This guide is updated towards firmware release HydraFW v0.10 and later
Bus: JTAG
Connections: four pins (TMS, TCK, TDI, TDO) and one optional pin (TRST)
Output types: 3.3volt normal output, or open drain
(pull-up/pull-down resistors integrated in MCU or external).
Pull-up resistors: required for open collector output mode (2K – 10K).
Pull-up/down resistors Integrated in MCU: Between 30 to 50K (Typical 40K).
Maximum Voltage: 5.5volts (5volt safe).
-
show
Show JTAG parameters orshow pins
Show pins used in this mode -
pull
with parameterup
ordown
orfloating
to choose internal MCU pull up/down or no pull/external -
msb-first
orlsb-first
to send/receive respectively MSB first or LSB first. -
tck
,tms
,tdi
andtdo
with an integer parameter to set the corresponding pin on PB (tms 1
sets TMS on pin PB1) -
brute
withbypass
oridcode
parameters is used to discover JTAG ports on an unknown device.-
bypass
to query the number of devices in the JTAG chain.-
brute bypass <integer>
Performs a BYPASS scan on x pins (PB0 up to PB11)
-
-
idcode
to get the devices IDCODEs in the JTAG chain.-
brute idcode <integer>
Performs an IDCODE scan on x pins (PB0 up to PB11)
-
-
-
openocd
to switch to openOCD mode. See OpenOCD guide -
exit
to exit JTAG mode
> jtag
Device: JTAG1
GPIO resistor: pull-up
Frequency: 2000000Hz
Bit order: LSB first
Hardware Informations:
jtag1> show pins
TMS:PB10 TCK:PB11 TDI:PB8 TDO:PB9 TRST:PB7
^
to send one clock tick
/
to set TCK level high
\
to set TCK level low
-
to set TDI level high
_
to set TDI level low
[
to set TMS level high
]
to set TMS level low
!
to read TDO with clock tick
.
to read TDO without clock tick
Connect several test pins on the board to analyze on HydraBus PBx pins, and run :
jtag1> brute idcode 10
Bruteforce on 10 pins.
TMS:PB0 TCK:PB3 TDI:Unused TDO:PB2 TRST:Unused
jtag1> brute bypass 8
Bruteforce on 8 pins.
TMS:PB0 TCK:PB3 TDI:PB1 TDO:PB2 TRST:Unused
jtag1> idcode
Device found. IDCODE : 3F0F0F0F
jtag1> bypass
Number of devices found : 1
Nb IO | Nb Pins | Nb Test |
---|---|---|
3 | 3 | 6 |
4 | 3 | 24 |
5 | 3 | 60 |
6 | 3 | 120 |
7 | 3 | 210 |
8 | 3 | 336 |
9 | 3 | 504 |
10 | 3 | 720 |
11 | 3 | 990 |
12 | 3 | 1320 |
Nb IO | Nb Pins | Nb Test |
---|---|---|
4 | 4 | 24 |
5 | 4 | 120 |
6 | 4 | 360 |
7 | 4 | 840 |
8 | 4 | 1680 |
9 | 4 | 3024 |
10 | 4 | 5040 |
11 | 4 | 7920 |
12 | 4 | 11880 |
For more details on JTAG see: https://en.wikipedia.org/wiki/Joint_Test_Action_Group
- CHANGELOG
- Console commands
- Binary mode guide
-
NFC/HydraNFC v1 guide
- Read UID of an ISO/IEC_14443 Tag
- Read UID and data of a MIFARE Ultralight Tag
- Read UID of an ISO/IEC 15693 Tag
- Emul ISO14443a Tag
- Emul MIFARE Ultralight Tag
- Emul Mifare Classic Tag
- Unique NFC sniffer design
- Launch NFC sniffer from console
- Sniffer ISO14443A wireshark pcap
- Autonomous/stand-alone sniffer mode
- Sniffer ISO14443A real-time infinite trace mode
- HydraFW-HydraNFC-v1.x-TRF7970A-Tutorial