5

When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer.

When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in identifying JTAG pinouts or pads.

What techniques exist for enumerating or identifying SWD pinouts?

pzirkind
  • 437
  • 1
  • 5
  • 9
  • I think the first possibility is to check the datasheet (if available) of the chip you want to access and try to trace the pins from there – gipi Feb 21 '18 at 15:55

1 Answers1

1

Not aware of any similar software tools for SWD, but:

  1. If you can see or infer the chip part number, look at the data sheet.

  2. Look for test points (or connectors) that may be used in factory programming. They will likely be connected directly to the chip, but SWDIO pins may or may not also double as some other function. Unlike JTAG, SWD will not be daisy-chained to several chips. Start out by looking for TPs connected only to that chip. There will be at least two TPs (SWDIO and SWCLK). They may or may not be located near TPs for GND, reset, SWO and VDDIO (used for detecting programming voltage).

  3. If the chip is not the main CPU, and it's possible to update the chip firmware, SWDIO pins may also be present in a board-to-board connector or on pins connected to the CPU (though it's also possible that the chip has a bootloader to be updated by other means than SWD). If this is the case, update the firmware while looking at various pins with a logic analyzer to find candidates for SWD.

esrever
  • 55
  • 1
  • 8