An Open JTAG Debugger
Travis Goodspeed explores an open jtag debugger at DEF CON 17, examining jtag and practical defenses.
Summary
Architecture and Background
An Open JTAG Debugger Travis Goodspeed Engineer of Superior Buckles, Goodspeed & Gourneau While it's simple enough to build a "Wiggler" JTAG adapter for the PC parallel port, there is very little open hardware for performing high-speed programming of JTAG devices by USB. This lecture introduces the GoodFET, an open source USB JTAG adapter which can be reflashed to support the programming and debugging of any number of chips.
Vulnerability Analysis
Both hardware and firmware are compared to that of a similar, commercial design. This lecture will also cover the details of the JTAG standard and a few of its competitors, as well as the possibility of attacking these debugging modes when access has been denied or restricted.
Exploitation and Demonstrations
Travis Goodspeed is a neighborly reverse engineer from Southern Appalachia. He has been exploiting and reverse engineering wireless sensors since writing the first stack overflow exploit for them in 2007.
Remediation and Defensive Strategies
His recent projects have included a timing attack on the MSP430 bootstrap loader and an extra-neighborly party-mode belt buckle in the shape of Tennessee. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·47 min
Joe Grand
Joe Grand explores jtagulator assisted discovery of on chip debug at DEF CON 21, examining jtag and practical defenses.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.