Yahoo Groups archive

Lpc2000

Index last updated: 2026-04-28 23:31 UTC

Message

Re: [lpc2000] re: CRP exploits using JTAG

2006-02-08 by Dominic Rath

Hello,

On Tuesday 07 February 2006 04:21, Jayasooriah wrote:
> I am curious if this is stated anywhere or if you determined this by
> experiment.  Note, besides ETM chain, there is also a processor chain that
> can be accessed.
>
Philips stated it, but only after several reports in this group, in the 
"[lpc2000] destroyed LPC2138 via software" thread (though with the usual 
amount of unclarity, stating that jtag was disabled after reset, and only 
reenabled by software ;)).
Before that, I found it out by experiment. Force nSRST low, and you can shift 
into the device whatever you want, without any effect. Also, the content of 
the EmbeddedICE registers is reset, so the target wont break on a previously 
set breakpoint (other ARMs support this).

> >Test logic comes out of reset in Test-Logic-Reset. From there, you have to
> >go to Shift-IR to select the SCAN_N instruction, that's 5 TCK cycles. The
> >IR register is 4 bits long, but the last bit is scanned when moving out of
> >Shift-IR, so you spend 3 ticks shifting bits into the IR reg. From there,
> >you have to move to Shift-DR to select the EmbeddedICE scan chain. This
> >takes 7 TCK cycles. The SCAN_N register is 4 bits long, so you shift 3
> >bits. Back to
> >Shift-IR to select INTEST takes 8 ticks. 3 ticks for the instruction. 7
> >Ticks back to Shift-DR. The EmbeddedICE scan chain is 38 bits long,
> >requiring a shift of 37 cycles. The synchronization latches only open in
> >Run-Test/Idle, so you have to move there in 5 ticks, plus one tick in
> >R-T-I for the debug request to register.
> >5 + 3 + 7 + 3 + 8 + 3 + 7 + 37 + 5 + 1 = 79 TCK cycles.
>
> I can  follow your logic here, but 79 ticks seems too far off the mark
> compared to 34 and 49 above.  Have out missed out something?

These 79 TCK cycles are the minimum necessary to write the Debug control 
register when coming out of Test-Logic-Reset. You just can't do it with less 
TCKs.

>
> Jaya

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.