JTAG & SWD
On-chip debug interfaces. Halt the CPU, read and write RAM and flash directly, and defeat readout protection.
JTAG (Joint Test Action Group) and SWD (Serial Wire Debug) are on-chip debug interfaces. Through them you halt the CPU core, single-step it, and read or write memory, registers, and flash directly. When the debug port is left open, you effectively own the chip: dump the firmware, patch RAM live, and walk past protections that only guard the normal boot path.
What it is
JTAG began as a boundary-scan standard (IEEE 1149.1) for testing solder joints and daisy-chaining chips; the same TAP (Test Access Port) state machine was extended to CPU debug. SWD is ARM's two-pin reduction of it, carrying the same debug transactions over fewer wires. The two share the underlying access; a target may expose one, the other, or both on the same pads.
| JTAG | SWD | Role |
|---|---|---|
| TCK | SWCLK | clock |
| TMS | SWDIO | mode select / bidirectional data |
| TDI | - | data in |
| TDO | - | data out |
| TRST (opt.) | - | TAP reset |
SWD needs only SWDIO, SWCLK, and GND, plus an optional VREF sense line so the probe matches the target's I/O voltage.
Why it matters
Debug access is the deepest hardware foothold short of decapping the die. With it you can dump firmware that no UART or network path would expose, bypass a bootloader password by reading RAM after unlock, patch a comparison in memory to defeat a check, and extract keys the running code has loaded. It is also the interface that vendors most often try to close with readout protection (STM32 RDP, NXP CRP, ESP32 JTAG-disable eFuse), which is exactly why finding it open matters.
How to work it
- Find the port. Look for a labelled 10-pin Cortex header, or bare pads. A
jtag-swd-probeplus a pin-brute tool (a JTAGulator, or OpenOCD's SWD line-reset scan) recovers unknown pinouts. - Connect the probe (ST-Link, J-Link, or a cheap CMSIS-DAP) and attach with OpenOCD:
openocd -f interface/stlink.cfg -f target/stm32f1x.cfg
# in another shell:
telnet localhost 4444
> halt
> dump_image fw.bin 0x08000000 0x20000
- Read the protection level before assuming access is full:
# STM32 example: read the option bytes / RDP level.
> mdw 0x1FFFF800 1
- If readout protection is set (RDP level 1/2, CRP), a direct dump is blocked; the paths then are voltage/clock glitching at the right instant, or documented debug-bypass sequences, not a clean read.
Pitfalls
- VREF and voltage: drive the probe at the target's I/O voltage. A 5V probe on a 1.8V core can damage pins.
- Some designs multiplex the JTAG/SWD pins with GPIO used by the application, so debug only works before the firmware reconfigures them, right after reset.
- RDP level 2 on STM32 is generally permanent; do not set it experimenting, and expect real targets to be at level 1 at best.
- A halted core can desynchronise timing-sensitive peripherals; a system reset via the probe is often needed to recover a clean state.