UART
Two-wire async serial link (TX/RX), the number-one hardware entry point on a board and often a direct root shell.
UART (Universal Asynchronous Receiver/Transmitter) is the simplest serial link on a board: two data wires, TX and RX, referenced to a common GND, with no shared clock. Both ends must agree on the same bit rate (baud) in advance, which is what makes it asynchronous. It is the first thing to look for when you open a device, because a debug UART is the most reliable path from a closed box to a live shell.
What it is
UART is a peripheral, not a multi-drop bus: it is a point-to-point, full-duplex link between exactly two endpoints. TX (transmit) on one side wires to RX (receive) on the other, and vice versa. The logic levels are plain TTL, almost always 3.3V on modern boards, occasionally 1.8V or 5V. UART is not RS-232, so never wire a true RS-232 port (plus/minus 12V) straight to a chip pin.
| Pin | Role |
|---|---|
| TX | device sends to you |
| RX | you send to the device |
| GND | common reference, mandatory |
VCC is usually left unconnected: you power the target from its own supply and only share GND. Common baud rates are 115200, 57600, 38400, and 9600.
Why it matters
Vendors leave a debug UART populated, or as bare test pads, on production hardware because they need it in the factory and for RMA. That header frequently drops you straight into the boot log, a U-Boot prompt, or an unauthenticated root console. Even when a login prompt guards it, the boot log alone leaks the SoC, the bootloader version, partition offsets, and the kernel command line, all of which feed the next step of an assessment.
How it works
The line idles HIGH. A frame begins with a falling edge (the start bit), followed by the data bits sent LSB first, an optional parity bit, then one or more HIGH stop bits. The near-universal format is 8N1: 8 data bits, no parity, 1 stop bit (see the timing diagram). Because an idle TX line rests near VCC, a multimeter on an otherwise quiet pin reading close to the rail is a strong TX candidate; RX floats or reads mid-scale, and GND has continuity to the board ground.
How to find and use it
- Locate the candidate pads. A four-pad inline group near the SoC is the classic tell. Use a
logic-analyzerto capture pin activity, or amultimeterin continuity mode to find GND and in DC-volts to spot the idle-HIGH TX. - Confirm the pinout: TX shows bursts on power-up, RX is quiet, GND is 0V.
- Wire a
usb-uartadapter cross-over: adapter RX to device TX, adapter TX to device RX, GND to GND. Set the adapter to the target voltage (3.3V). - Open a terminal and watch the boot:
# 115200 is the most common rate; try it first.
picocom -b 115200 /dev/ttyUSB0
# Unknown baud? sweep candidates against the boot banner.
for b in 115200 57600 38400 19200 9600; do
echo "== $b =="; timeout 3 picocom -qrb $b /dev/ttyUSB0 | cat -v | head
done
- To interrupt the bootloader, spam a key during the countdown to land in the U-Boot prompt, where you can dump memory, alter the boot arguments, or inject
init=/bin/sh.
Pitfalls
- Mixing voltage domains: a 5V adapter on a 3.3V pin can damage the target. Match levels first.
- TX/RX naming is from the device's point of view, so the cross-over trips people up. If you see nothing, swap TX and RX.
- Sharing VCC when you should share GND: never back-power the target through the adapter unless you know it is safe.
- A quiet console does not mean no UART: some ports are RX-only in the field or gated behind a bootloader password. The boot log is still worth capturing.