Electronic – Reverse engineering target chip to be used with OpenOCD

jtagopenocdreverse-engineering

I have a board that has JTAG pins and I want to connect OpenOCD to the board. However the CPU chip identification number is not written on the chip and I couldn't find the datasheet of the board.

What do I need to do in order to find the chip identification number?

Best Answer

The JTAG specification (which is reasonably described on the wikipedia page) defines an IDCODE instruction as part of the mandatory implementation, and a scan chain intended for debug will typically conform to this part of the spec to provide tools with some basic access information. Remember that even for a single chip, there can be multiple TAPs in series, and the data register is a big shift register (so you can test its length).

Once you have ID register value, you can start to identify the part. If it has an ARM CoreSight DAP, this bridges the JTAG accesses to a memory mapped debug bus. You can locate the ROM table which provides the address locations of all debug components, one of which should be CPU debug.

To perform these accesses, you'll need to use the low level raw JTAG accesses in openocd, rather than accessing through the more typical debugger GUI. The openOCD manual is the best place to start for this.

Related Topic