-
Notifications
You must be signed in to change notification settings - Fork 92
HydraFW JTAG guide
#HydraFW Bus JTAG (Joint Test Action Group)
Bus: JTAG
Connections: four pins (TMS, TCK, TDI, TDO) and one optional pin (TRST)
Output types: 3.3volt normal output, or open drain
(pull-up/pull-down resistors integrated in MCU or external).
Pull-up resistors: required for open collector output mode (2K – 10K).
Maximum Voltage: 5.5volts (5volt safe).
This guide is updated towards firmware release HydraFW v0.6 Beta: HydraFW (HydraBus) v0.6-beta-0-g897f173 2015-11-29
##Protocol configuration syntax description:
-
show
Show JTAG parameters orshow pins
Show pins used in this mode -
pull
with parameterup
ordown
orfloating
to choose internal MCU pull up/down or no pull/external -
msb-first
orlsb-first
to send/receive respectively MSB first or LSB first. -
tck
,tms
,tdi
andtdo
with an integer parameter to set the corresponding pin on PB (tms 1
sets TMS on pin PB1) -
brute
withbypass
oridcode
parameters is used to discover JTAG ports on an unknown device. -
bypass
to query the number of devices in the JTAG chain. -
idcode
to get the devices IDCODEs in the JTAG chain. -
openocd
to switch to openOCD mode. See OpenOCD guide -
exit
to exit JTAG mode
> jtag
Device: JTAG1
GPIO resistor: floating
Bit order: LSB first
##Configuration options:
Hardware Informations:
jtag1> show pins
TMS: PB10
TCK: PB11
TDI: PB8
TDO: PB9
##Protocol interaction syntax description:
r
or read
Read one packet. (r:1…255 for bulk reads)
w
or write
Followed by values to write byte(s). (w:1…255 for bulk writes)
0
Write this Octal value. Format is prefixed by a 0 (values from 000 to 077)
0b
Write this binary value. Format is 0b00000000 for a byte, but partial bytes are also fine: 0b1001.
0x
Write this HEX value. Format is 0x01. Partial bytes are fine: 0xA. A-F can be lower-case or capital letters.
0-255
Write this decimal value. Any number not preceded by 0x, or 0b is interpreted as a decimal value.
Write support optional repeat :
(eg.: 10:1…255 for repeated write of same value 10 in this example)
space
Value delimiter.
Use a space to separate numbers/commands.
Any combination is fine, delimiter is required between each number/command, Example: 0x1 0xff 0 10 0b11 077
^
to send one clock tick
/
to set TCK level high
\
to set TCK level low
-
to set TDI level high
_
to set TDI level low
[
to set TMS level high
]
to set TMS level low
!
to read TDO with clock tick
.
to read TDO without clock tick
&
Delay 1uS. (&:1…1000000 for multiple delays)
%
Delay 1mS. (%:1…1000000 for multiple delays)
~
Write a random byte. (~:10 repeats the same random byte 10 times)
###Protocol interaction example usage JTAG1 to discover JTAG pins: Connect several test pins on the board to analyze on HydraBus PBx pins, and run :
jtag1> brute idcode 12
Bruteforce on 12 pins.
Device found. IDCODE : FC300037
TMS: PB8 TCK: PB9 TDO: PB7
jtag1> brute bypass 12
Bruteforce on 12 pins.
TMS: PB8 TCK: PB9 TDI: PB6 TDO: PB7
##Additional informations about JTAG
For more details on JTAG see: https://en.wikipedia.org/wiki/Joint_Test_Action_Group
- CHANGELOG
- Console commands
- Binary mode guide
-
NFC/HydraNFC v1 guide
- Read UID of an ISO/IEC_14443 Tag
- Read UID and data of a MIFARE Ultralight Tag
- Read UID of an ISO/IEC 15693 Tag
- Emul ISO14443a Tag
- Emul MIFARE Ultralight Tag
- Emul Mifare Classic Tag
- Unique NFC sniffer design
- Launch NFC sniffer from console
- Sniffer ISO14443A wireshark pcap
- Autonomous/stand-alone sniffer mode
- Sniffer ISO14443A real-time infinite trace mode
- HydraFW-HydraNFC-v1.x-TRF7970A-Tutorial