> But taking advantage of that feature requires a five-figure-priced JTAG debugger Reading RAM in a running system (even a "hardened" one) is easier than most

> But taking advantage of that feature requires a five-figure-priced JTAG debugger Reading RAM in a running system (even a "hardened" one) is easier than most think. Micah Elizabeth Scott's work on the Nintendo DSi [1] is an excellent example: with a budget of just $500 and a month or two of work [2] she could read a video stream out of RAM as it was being DMAed to/from the camera [3]. I can't even begin to describe how impressed I am with Micah's work, but cloning her FPGA tool from GitHub [4] and repeating the feat for a relatively static segment of executable code on a system that's less physically hardened against tampering, that seems trivial to me in comparison. Certainly doable with $500 and a couple of weeks time. 1. http://scanlime.org/2009/09/dsi-ram-tracing/ http://scanlime.org/2009/09/dsi-ram-tracing/ 2. https://twitter.com/scanlime/status/562925122106191873 https://twitter.com/scanlime/status/562925122106191873 3. http://hackmii.com/2009/09/dsi-ram-tracing-camera/ http://hackmii.com/2009/09/dsi-ram-tracing-camera/ 4. https://github.com/scanlime/ram-tracer https://github.com/scanlime/ram-tracer