Hi, welcome back.
In this lesson, we will talk about JTAG exploitation.
JTAG stands for Joint Action Group, is an industry standard for verifying designs and testing printed
circuit boards after manufacture.
There is also an alternative to JTAG interface that is
SWD (Serial Wired Debug) that has the same JTAG protocol on top. SWD uses an ARM CPU standard
bidirectional wire protocol, defined in the ARM Debug interface version five.
JTAG specifies the use of a dedicated debug port implementing a serial communications interface
for low-overhead access without requiring direct external access to the system address and data buses.
The interface connects to an on-chip Test Access Port (TAP) that implements a stateful
protocol to access a set of test registers that present chip logic levels and device capabilities of
various parts.
Regarding accessing and using the interface, there are five signals that Test Access Ports uses:
the TCK Test Clock port,
TDI Test Data In
TDO Test Data Out, TMS Test Mode Select, and an optional port TRST the Test Reset port
The image shows a printed circuit board related to a router Linksys, showing the JTAG interface
with 14 pins.
Now let's see the steps to follow, to verify the security of the JTAG interface with respect,
for example, to the possibility of extracting data directly from a device via the JTAG interface.
The first step is to identify JTAG pinouts (TCK, TDO, TDI, TMS) on the printed
circuit board of the Iot device. For the identification of the JTAG
pinouts different tools can be used, among which the JTAGulator tool and the JTAGEnum Arduino based
project.
Consultation of the datasheet of device could also be useful for this activity.
Then the second step is to connect the JTAG pinouts to PC via a USB-TTL converter interface, for example,
the Attify badge or BusPirate or other similar.
And here we can see a schematic connection of a development board with JTAG debug interface connected
to an analysis PC through an Attify badge interface.
The next step is to interact with the device from PC through JTAG interface communication, for example,
using OpenOCD utility, openOCD stands for Open On-Chip Debugger.
openocd command activates for interaction with the device two server sockets, one on Port 4444,
to which you can connect with telnet, and one port on 3333
to which you can interact via GDB.
Through JTAG, it is possible to: debug binaries, dump firmware, write firmware. The slide shows
some openocd commands, for example, the dump_image command that allows to dump size bytes
of target
memory starting at a specified address to a binary file, named filename in the usage example.
Another command of openocd, is the mdw command that allows to display contents of address addr as 32
bit words.
For a complete list of commands, you can consult the user's guide section of the official site openocd
dot org.
OK, thank you for your attention bye.