Table of Contents

Table of Contents

Table of Contents

1. Diving into JTAG
2. Intro
   1. Who Is This Book For?
   2. How to read this book
   3. Feedback
   4. Support
3. 1. Overview
   1. 1.1 Test Access Point (TAP)
   2. 1.2 Control signals
   3. 1.3 Registers
      1. 1.3.1 Shift register
   4. 1.4 JTAG Instruction
      1. 1.4.1 The IDCODE instruction
      2. 1.4.2 The Boundary Scan instructions
      3. 1.4.2 The BYPASS instruction
   5. 1.5 TAP State Machine
   6. 1.6 Example
4. 2. Debugging
   1. 2.1 JTAG Access to the STM32F407VG Controller
      1. 2.1.1 Read of IDCODE
   2. 2.2 Interaction with memory
      1. 2.2.1 Writing a variable to memory
      2. 2.2.2 Reading a variable from memory
   3. 2.3 Interacting with the Processor Core
5. 3. Boundary Scan
   1. 3.1 The Principle of Boundary-Scan
   2. 3.2 The Boundary Scan Cells
   3. 3.3 The Boundary Scan Register
   4. 3.4 The Boundary Scan Instructions
      1. 3.4.1 SAMPLE Instructions
      2. 3.4.2 PRELOAD Instructions
      3. 3.4.3 SAMPLE/PRELOAD Instructions
      4. 3.4.4 EXTEST Instructions
      5. 3.4.5 INTEST Instructions
   5. 3.5 Example of Testing
6. 4. BSDL
   1. 4.1 Syntax
      1. 4.1.1 Entity Descriptions
      2. 4.1.2 Generic Parameter
      3. 4.1.3 Logical Port Description
      4. 4.1.4 Pin Mapping(s)
      5. 4.1.5 Scan Port Identification
      6. 4.1.6 IDCODE Register Description
      7. 4.1.7 Instruction Register Description
      8. 4.1.8 Register Access Description
      9. 4.1.9 Boundary Register Description
7. 5. Usage Scenarios
   1. 5.1 Getting Started
   2. 5.2 Board Bring Up
      1. 5.2.1 GPIO Output Control
      2. 5.2.2 GPIO Input State View
   3. 5.3 Revers Enginnering
8. 6. Security
   1. 6.1 Protection
      1. 6.1.1 Board-Level
      2. 6.1.2 Chip-Level
   2. 6.2 Attack
      1. 6.2.1 Detecting JTAG pins
         1. 6.2.1.1 IDCODE Scan
         2. 6.2.1.2 BYPASS Scan
      2. 6.2.2 Attack on JTAG
         1. 6.2.2.1 Determining the number of TAPs in a JTAG chain
         2. 6.2.2.2 Determining the size of IR and DR
         3. 6.2.2.3 Defining undocumented JTAG instructions
      3. 6.2.3 Debug Port (RDP) Attack
         1. 6.2.3.1 Firmware dumping technique for an ARM Cortex-M0 SoC
         2. 6.2.3.2 nRF52 Debug Resurrection (APPROTECT Bypass)
9. Appendix A: ARM Debug Access Port
   1. A.1 The external interface, the Debug Port (DP)
      1. A.1.1 JTAG Debug Port (JTAG-DP)
         1. A.1.1.1 JTAG Registers
         2. A.1.1.2 Debug Port Registers
         3. A.1.1.3 Accessing the DP registers
   2. A.2 The resource interface, the Access Ports (AP)
      1. A.2.1 Memory Access Port Registers
      2. A.2.3 Addressing of AP Registers
      3. A.2.2 Accessing the AP registers
   3. A.3 Practical Part
      1. A.3.1 Writing a variable to memory
      2. A.3.2 Reading a variable from memory

Landmarks

1. Begin Reading