3 ms·
I’m driving, but don’t want to forget this later... do you think you could help me with a 30 second run down on Intel JTAG? I assume not all chips have the sam
by SlowRobotAhead 8y ago
I’m driving, but don’t want to forget this later... do you think you could help me with a 30 second run down on Intel JTAG?
I assume not all chips have the same JTAG password. I assume JTAG can be accessed via software running on the processor itself and not require explicit physical access. I assume there is a hack that allows someone to obtain their processor JTAG password, how that works is what I’m most interested in I suppose.
- scandinavian 8y agoI skimmed the slides. The password is unique per cpu. There is no hack presented in the slides to get the password, and they directly say they couldn't get the password for their system. Their evidence seems mostly based on this pdf: https://web.archive.org/web/20190213084218/http://www.keenlit.com/wp-content/uploads/2018/03/IFDIM-BKM-1.pdf https://web.archive.org/web/20190213084218/http://www.keenli... There is nothing in the slides about accessing JTAG from the processor itself, and in the pdf above you can see the JTAG equipment on page 12. That's about it. I'm no expert at all, just relaying what's in the slides.
- userbinator 8y agoJTAG requires physical access.
- jakeogh 8y agoHow so? Hack a net-connected USB device that the target is using.
- scandinavian 8y agoThe net-connected device would need to be connected with a USB 3.0 debugging cable. Also DCI would need to be enabled on the computer.
- jakeogh 8y agoCan it be done via DbC? https://www2.lauterbach.com/pdf/dci_intel_user.pdf https://www2.lauterbach.com/pdf/dci_intel_user.pdf
- scandinavian 8y agoYes, as I said, if DCI is already enabled and the device is connected via. a USB 3.0 debug cable. It can be made like this: https://github.com/ptresearch/IntelTXE-PoC#preparing-the-usb-debug-cable https://github.com/ptresearch/IntelTXE-PoC#preparing-the-usb... Or you can buy one from Intel.
- amluto 8y agoI would guess that many USB devices can make themselves look like debug cables with minor firmware modifications.