Hardware hacking (UART, JTAG)

Physical access to an embedded device’s hardware opens debug interfaces (UART, JTAG/SWD) and memory chips that often grant full access: a root console, firmware dumping, and memory read/write. It’s the starting point of many IoT analyses (IoT pentest/Firmware analysis).

Debug interfaces

UART   serial console (TX/RX/GND); often gives a root SHELL or the boot log
       -> identify pins, baud rate, connect a USB-TTL adapter
JTAG   debug/boundary scan (TDI/TDO/TCK/TMS); full processor control
SWD    2-pin variant of JTAG (ARM Cortex-M)
# finding the pins: PCB inspection, chip datasheet, JTAGulator

Memory chips

SPI flash   stores the firmware; can be DUMPED with a clip (SOIC) + programmer
            -> chip-off or in-circuit; read with flashrom/a programmer (CH341A, etc.)
eMMC/NAND   larger storage; more complex to dump
# dumping the flash = obtaining the firmware for analysis (ot-firmware)

Typical flow

1. open the device, inspect the PCB, and identify chips (datasheets)
2. locate UART/JTAG (test points, headers); JTAGulator/logic analyzer to map
3. UART: connect USB-TTL, find the baud rate -> console/boot log -> sometimes a direct root shell
4. dump the SPI flash (clip + programmer) -> extract firmware (ot-firmware)
5. JTAG/SWD: read/write memory, bypass protections, debug

Tools

Adapters     USB-TTL (UART), Bus Pirate, JTAG adapters (see OpenOCD)
Diagnostics  multimeter, logic analyzer (Saleae/clones), JTAGulator
Memory       SOIC8 clip, SPI programmer (CH341A), flashrom
Software     OpenOCD (JTAG/SWD), minicom/screen (serial), Ghidra (ot-firmware/pwn-reversing)

What you get

- root shell via UART -> device control and live FS access
- firmware dump -> credentials/keys/vulns (ot-firmware)
- memory read/write via JTAG -> bypass secure boot, extract secrets
- a basis for finding vulns to then exploit remotely (ot-iot)

Blue Team / manufacturer

Disable/fuse UART/JTAG in production (disable debug, blow fuses) or protect them.
Encrypt the firmware in flash and use secure boot (dumping the flash must not reveal secrets).
Per-device secrets in secure elements (TPM/secure element), not in cleartext flash.
Tamper detection on high-value devices.

CVEs and real-world cases

Countless devices give a root shell via UART without authentication (a physical backdoor).
Dumping SPI flash to extract firmware and keys is routine in IoT research.
Bypassing secure boot via JTAG/implementation flaws has broken consoles and closed devices.

Testing checklist

Open and document the PCB; identify chips (datasheets)
Locate UART/JTAG/SWD (test points, JTAGulator)
UART: find baud rate and access console/boot log
Dump the SPI flash (clip + programmer) → firmware (Firmware analysis)
JTAG/SWD with OpenOCD: read/write memory
Look for secrets and protections (secure boot, flash encryption)
All on your own device / with authorization