04 - Hardware Debugging Interfaces

During development, engineers rely on debug interfaces to flash firmware and diagnose issues. If left exposed in production, they offer root-level access to the hardware.

UART (Universal Asynchronous Receiver-Transmitter)

UART is a serial communication protocol heavily used for debug consoles.

• The Threat: Attackers finding RX/TX pins on a PCB can hook up a USB-to-TTL adapter and access root shells left running, or read verbose debug logs containing passwords.
• Defenses: Disable console output in production builds. Require authentication on the serial shell.

JTAG and SWD

JTAG (Joint Test Action Group) and SWD (Serial Wire Debug) provide direct access to the CPU core.

• The Threat: An attacker can halt the CPU at any instruction, read out memory (including firmware and RAM), manipulate registers, and alter program execution.
• Defenses:
  • Blow the fuses: Microcontrollers have specific eFuses (One-Time Programmable memory) that permanently disable JTAG once programmed.
  • Cryptographic Debugging: Modern chips require a cryptographically signed certificate to unlock the JTAG interface.

Hardware Hacking Tools

1. The Logic Analyzer (e.g., Saleae)

A logic analyzer is used to capture and decode digital signals (I2C, SPI, UART). Attackers use it to sniff communications between the main CPU and a peripheral (e.g., an EEPROM chip or Secure Element).

2. The Bus Pirate

The Bus Pirate is a versatile tool that acts as a translator between a PC and various hardware protocols. It can be used to fuzz interfaces, dump EEPROM contents over SPI, or bruteforce I2C addresses.

3. OpenOCD (Open On-Chip Debugger)

Software used in conjunction with a hardware adapter (like J-Link or FTDI) to interface with JTAG/SWD.

Example OpenOCD workflow to dump firmware:

# Start OpenOCD targeting an STM32 chip
openocd -f interface/stlink.cfg -f target/stm32f4x.cfg

# In a separate terminal, connect via Telnet
telnet localhost 4444

# Halt the CPU
> halt

# Dump 1MB of flash memory starting at address 0x08000000
> dump_image firmware.bin 0x08000000 0x100000