1 line
181 KiB
JSON
1 line
181 KiB
JSON
|
{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"","title":"\ud83d\udd0c Hardware All The Things","text":""},{"location":"#welcome-to-the-hardware-wiki","title":"Welcome to the Hardware wiki!","text":"<p>Welcome to our comprehensive Hardware Security Wiki, a curated collection of valuable payloads and bypass techniques tailored for Hardware and IoT Security. This repository serves as a dynamic and collaborative space, encouraging contributions from security enthusiasts and professionals alike.</p> <p> </p> <p>Our goal is to foster a community-driven platform where individuals can share, learn, and enhance their skills in hardware and IoT security. Whether you are a seasoned security expert or just starting, this repository is designed to provide you with a wealth of knowledge and practical insights.</p> <p> Informations from this repository is very dense, you may encounter information overflow</p>"},{"location":"#contribute-and-collaborate","title":"Contribute and Collaborate","text":"<p>We believe in the power of community and collective knowledge. Therefore, we warmly invite you to contribute your unique payloads, bypass techniques, and innovative strategies to enrich our repository. Your contributions help keep this project alive and kicking, ensuring that we can continue to bring you the latest and greatest in hardware and IoT security.</p> <p> </p> <p>You can also share the project and contribute with a Github Sponsorship. </p>"},{"location":"debug-interfaces/jtag/","title":"JTAG","text":""},{"location":"debug-interfaces/jtag/#summary","title":"Summary","text":"<ul> <li>JTAG Pins</li> <li>JTAGEnum</li> <li>References</li> </ul>"},{"location":"debug-interfaces/jtag/#jtag-pins","title":"JTAG Pins","text":"<p>Allows testing, debugging, firmware manipulation and boundary scanning</p> <p>TCK: Test Clock The drummer, or metronome that dictates the speed of the TAP controller. Voltage on this pin simply pulses up and down in a rhythmic, steady beat. On every \u201cbeat\u201d of the clock, the TAP controller takes a single action. The actual clock speed is not specified in the JTAG standard. The TAP controller accepts its speed from the outside device controlling JTAG.</p> <p>TMS: Test Mode Select Voltages on the Mode Select pin control what action JTAG takes. By manipulating the voltage on this pin, you tell JTAG what you want it to do.</p> <p>TDI: Test Data-In The pin that feeds data into the chip. The JTAG standard does not define protocols for communication over this pin. That is left up to the manufacturer. As far as JTAG is concerned, this pin is simply an ingress method for 1s and 0s to get into the chip. What the chip does with them is irrelevant to JTAG.</p> <p>TDO: Test Data-Out The pin for data coming out of the chip. Like the Data-In pin, communication protocols are not defined by JTAG. TRST: Test Reset (Optional) This optional signal is used to reset JTAG to a known good state, we'll explain why this is optional in a few paragraphs.</p> <p>AVR has lock bits that protects device from extracting flash</p> <ul> <li>Removing this lockbits will erase entire device</li> <li>If you have them set, you\u2019re not lucky, try to get firmware from other sources</li> </ul> <pre><code># Read fuses and lock bits using avarice \u2013r\n$ avarice --program --file test.elf --part atmega128 --jtag /dev/ttyUSB0 :4444\n# Acquire firmware using avrdude\n$ avrdude -p m128 -c jtagmkI \u2013P /dev/ttyUSB0 -U flash:r:\u201d/home/avr/flash.bin\":r\n</code></pre>"},{"location":"debug-interfaces/jtag/#enumeration-methods","title":"Enumeration methods","text":"<p>For enumeration methods see Enumeration/JTAG</p>"},{"location":"debug-interfaces/jtag/#references","title":"References","text":"<ul> <li>JTAGulator vs. JTAGenum, Tools for Identifying JTAG Pins in IoT Devices by Dylan Ayrey</li> <li>JTAG PIN Identification - February 21, 2017</li> <li>Hardware Debugging for Reverse Engineers Part 2: JTAG, SSDs and Firmware Extraction - Posted Apr 2, 2020 by wrongbaud</li> </ul>"},{"location":
|