HardBreak
GitHubDiscordLinkedInX
  • HardBreak - Hardware Hacking Wiki
  • Introduction
    • How to start
    • Methodology
    • Case Study (Led to a CVE Update)
      • General Case Study
  • Hardware Hacking
    • Introduction
    • Basics
      • Tools
        • Hardware Tools
          • Essential Tools
          • Soldering Tools
          • Logic Analyzer
            • Saleae Logic Analyzer
          • Open-Source Tools
            • Bus Pirate v3.6
            • Bus Pirate 5
            • GoodFET
          • Multimeters & Oscilloscopes
          • JTAG and SWD Debuggers
            • Segger JLink
            • TI CC-Debugger
          • UART-to-TTL adapter
          • Chip readers and programmers
            • Xgecu T56
        • Software Tools
          • Binwalk
          • Firmwalker
          • flashrom
          • Ghidra
          • OpenOCD
          • Mitmrouter
      • Common Hardware Components
      • Firmware Extraction Methods
      • Ethics
    • Reconnaissance
      • Closed device
        • OSINT (search the web)
        • USB Ports / SD-card
      • Opened device
        • Board Analysis
    • Interface Interaction
      • UART
        • Identify UART
        • Connect to UART
        • Extract Firmware using UART
      • I2C
      • SPI
        • Extract Firmware using SPI
      • JTAG/SWD
        • JTAG
          • Identify JTAG
        • SWD
        • Extract Firmware using JTAG/SWD
      • VE.Direct
    • Bypassing Security
      • Voltage Glitching
        • Example: LPC1768
      • Electromagnetic Fault Injection
    • Analyze Firmware
  • Network Analysis
    • Introduction
    • Reconnaissance
    • Protocols
      • WIFI
        • WEP
        • Deauthentication Attacks
      • Application Layer
        • Proprietary Protocols
          • Parrot Anafi Drone Reverse Engineering
        • MQTT
        • CoAP
        • Web Sockets
  • Radio Hacking
    • Introduction
    • Reconnaissance
    • Protocols
      • NFC
      • RFID
    • Tools
      • RF Signal Analyzers
        • RTL-SDR
        • HackRF
      • Flipper Zero
        • NFC
        • Sub-GHz
  • Contribute
    • How to contribute
    • Gitbook - Basics
      • Markdown
      • Images & media
      • Interactive blocks
  • About
    • Impressum – Legal Notice
    • Privacy Policy
    • Datenschutzerklärung
    • License
Powered by GitBook
On this page
  • Connect to UART
  • Interact with UART
  • Identifying the correct baud rate

Was this helpful?

Edit on GitHub
  1. Hardware Hacking
  2. Interface Interaction
  3. UART

Connect to UART

PreviousIdentify UARTNextExtract Firmware using UART

Last updated 4 months ago

Was this helpful?

At this point you should have:

  • Understand what UART does (if not check: )

  • Identified UART pins (if not check:)

Connect to UART

You need to find the GND (ground), TX (transmit) and RX(receive) pins to send and receive data with UART (RX pin is not required to just read data).

When you connect the UART-USB adapter with the UART interface on the board, you have to connect RX and TX together like this:

There are different ways to connect to identified test pads:

If you are lucky, you find header pins where you can connect jumper cables to it. This is the easiest way to connect your UART-to-TTL USB adapter to an UART interface.

If your device has holes in the pcb for the UART connection, you can attempt to put jumper cables through it and tilt them, so they have a solid contact point:

If you own clamps or grabbers, you can use them to hook them up to the UART connector. These clamps have small hooks which you can hookup to the connector. This is not very usable if you only have flat connector pads.

Here an example when the clamps are attached:

Another option is to solder cables to the connector you found. This is especially useful if you only find flat pads to connect to.

Interact with UART

On your PC use the following command to communicate over UART (you may have to adjust the baud rate)

sudo minicom -D /dev/ttyUSB0 -b 115200
sudo picocom -b 115200 -r -l /dev/ttyUSB0

Change the 115200 with the baud rate of your device (how to identify: see below)

Using PuTTY (Windows):

  • Select “Serial” and enter the COM port (e.g., COM3) and baud rate (115200).

  1. If you see readable data: You done it correctly!

  1. If you see unreadable data then you probably have the wrong baud rate. Example

Identifying the correct baud rate

  • Quick win: Try to guess the baud rate, the most common ones are:

    • 9600, 38400, 19200, 57600, 115200 (which is probably the most common of all)

    • When hovering your capture with the mouse in the Saleae Logic Software you can see the the width is equal to 111.111kHZ which is very close to 115200, so we should choose this baud rate

Congrats! You found your first serial connection! Check out the UART chapter on how to use this to dump the firmware from the device.

Next, you can also connect your adapter to the UART interface using probes like the professional or self-printed versions like this one:

is a script, which tests automatically for different baud rates

You can also try to manually identify the correct baud rate using a

PCBite
Baudrate.py
logic analyzer
UART
Identify UART
Connect RX to TX and TX to RX
Header pins exposed, connect jumper cables here
Put the male pins through the connector holes
Clamp with Hook
Clamps attached
2 cables soldered to UART
Connect the needle pins to the UART interface
Bootlog
Wrong baud rate produces unreadable data
Use logic analyzer to get correct baud rate