An Arduino/Raspberry Pi tool to scan for JTAG pins and enumerate undocumented instructions on embedded devices.
JTAGenum is an open-source hardware security tool that uses Arduino-compatible microcontrollers or Raspberry Pi to scan for JTAG interfaces on embedded devices. It helps identify JTAG pins, enumerate the Instruction Register for undocumented instructions, and perform boundary scans, making it valuable for reverse engineering and security testing of hardware.
Hardware security researchers, embedded systems engineers, and reverse engineers who need to analyze or debug JTAG-enabled devices without proprietary tools.
JTAGenum is a cost-effective, DIY alternative to commercial JTAG tools, offering pin scanning and instruction enumeration capabilities with support for common microcontroller platforms and detailed cross-talk mitigation.
Given an Arduino compatible microcontroller or Raspberry PI (experimental), JTAGenum scans pins[] for basic JTAG functionality and can be used to enumerate the Instruction Register for undocumented instructions. Props to JTAG scanner and Arduinull which came before JTAGenum and forwhich much of the code and logic is based on. Feel free to branch and modify religiously (readme, credits, whatever)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses affordable Arduino or Raspberry Pi boards, making JTAG analysis accessible without expensive proprietary tools, as highlighted in the philosophy section.
Performs JTAG pin identification, instruction register enumeration, and boundary scans, covering key reverse engineering needs from the features list.
Includes loopback checks and pull-up resistor settings to mitigate false positives from wiring issues, with step-by-step guidance in the README.
Code is forkable and modifiable, allowing researchers to adapt it for specific targets, as encouraged in the authors section and TODO list.
The README explicitly states Raspberry Pi implementation is experimental with mixed results, reducing reliability for critical tasks.
Requires manual pin array definition, voltage shifting for different targets, and cross-talk management, adding significant initial effort per the hardware and usage sections.
The shift_bypass function is admitted as broken in the README, limiting compliance with some JTAG standards.
Supports 5V/3.3V but necessitates additional shields or modifications for compatibility, increasing cost and complexity as noted in the hardware appendix.
JTAGenum is an open-source alternative to the following products:
JTAGfinder is a tool for identifying and debugging JTAG (Joint Test Action Group) interfaces on electronic devices for hardware testing.
MiracleBox is a software tool used for flashing, unlocking, and repairing mobile phones, particularly Android devices, through various hardware box connections.