Ctrlk
GitHubDiscordLinkedInX
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Extract Firmware using JTAG/SWD

If you found an active JTAG/SWD interface on a PCB it can be used to extract the firmware in some cases.

Requirements

Hardware

  1. Target Device

  2. JTAG/SWD Debugger ( like ST-Link, J-Link, or Bus Pirate.

  3. JTAG/SWD Header/Pinout (TCK, TMS, TDI, TDO for JTAG or SWDIO, SWCLK for SWD).

  4. Jumper Wires (to connect the debugger to the target device)

  5. Power Source

Software

  1. Debugger-Tools: Open On-Chip Debugger (OpenOCD) or JLINK-Commander software for communicating with the JTAG/SWD interface.

  2. Drivers: Drivers for your specific debugger (e.g., ST-Link or J-Link drivers).

Steps to Extract Firmware Over JTAG/SWD

1. Identify JTAG/SWD Pins

  • Locate the JTAG or SWD pins on the target device. These are often labeled as follows:

    • JTAG Pins:

      • TCK (Test Clock)

      • TMS (Test Mode Select)

      • TDI (Test Data In)

      • TDO (Test Data Out)

      • GND (Ground)

    • SWD Pins:

      • SWDIO (Serial Wire Data Input/Output)

      • SWCLK (Serial Wire Clock)

      • GND (Ground)

  • Consult the device datasheet or use tools like a multimeter or datasheets to map out the connections.

2. Connect the Debugger

  • Use jumper wires to connect the JTAG/SWD pins on the target device to the corresponding pins on the debugger:

    • For JTAG: Connect TCK, TMS, TDI, TDO, and GND. (sometimes also RESET is needed)

    • For SWD: Connect SWDIO, SWCLK, and GND.

  • Make sure the connections are secure to avoid communication failures.

3. Set Up Software and Dump firmware

  1. Install OpenOCD to manage communication between your debugger and the target device.

  2. GDB: Install GNU Debugger for low-level device control.

Configure OpenOCD

  • OpenOCD needs to be configured with the appropriate settings for your device. You can use pre-existing configuration files or create your own. For example:

  • Create a configuration file (my_device.cfg) that defines the target and interface:

  • Then, launch OpenOCD with:

If the connection is correct we should see an output like this:

We can see that we have two options to interact with OpenOCD: telnet and gdb

Telnet:

  1. Connect to OpenOCD via Telnet:

Open a separate terminal and connect to the OpenOCD server:

  1. Successful connection output:

Once connected, you should see something like this:

  1. Commands you can use via Telnet:

Here are a few example commands you might use via Telnet:

GDB:

Commands to Dump Firmware Using J-Link Commander

  1. Start J-Link Commander: Run the JLinkExe command to launch J-Link Commander.

  2. Connect to the Target: You will need to specify the target device and the connection interface. For example, for an STM32F4 target connected via JTAG, you might see the following prompt:

    Enter the target details:

    Interface selection:

  3. Halt the Target: To ensure a consistent firmware dump, halt the CPU:

    Expected output:

  4. Read Memory and Dump to a File: Use the savebin command to dump the firmware (Adjust the Offset and size depending on your targets memory map).

    • firmware_dump.bin: The name of the binary file where the memory content will be saved.

    • 0x08000000: Start address of the firmware (for most STM32 devices, this is the start of flash memory).

    • 0x10000: The size of the memory region to dump (in this case, 64KB).

Full Example Session

After dumping the firmware

=> Jump to the Analyze Firmware section

Resources

PreviousSWDNextVE.Direct

Last updated