Extracting Firmware from External Memory via JTAG

Demonstration of extracting firmware from an embedded system through the JTAG interface.

It's Nerd Thunder month! Check out the folks mentioned at the end of the video:

[jimmylim]

hollyyy.. how in the world only 5000+ people interested in this sort of thing to date...

[sintaklaas]

Great content, thanks from Palermo, Sicily

[renakunisaki]

Thank you for explaining every step. It's so frustrating when a tutorial just pulls some information out of their arse without explaining it.

[HackaweekTV]

Nice one Joe! Good to see you hackin hardware! :) Have a great new year and...
KEEP ON HACKIN!

[koenigsbier]

I wish I could upvote this video a thousand times. This is awesome !

[TommyAventador]

I wonder if this would work on new iphones to retrieve icloud email?

[Cotten-]

You are such a great teacher. I wish I could shadow you.

[usbbdm]

Just in case you do not know, using USB JTAG NT can read the 4M flash under 20 seconds. Not 5 hours. That is too long. Check my videos on routers programming.

[zerodegrekelvin]

Thanks for the demo of poor man Bus Blaster JTAG 8-) I mostly use/loan the BDI2000/3000 from where I worked and I feel pain when you waited 5h to extract 4MB.
When I say "poor man" it does not mean pejorative, more of MacGyver compliment.

[woolfy]

I just got a bus pirate 3.6a and, I'm wanting to connect to a device using JTAG. The available pins on it are:

TDO, TDI, TMS, TCK, GND, RESET

Do I just connect it the same named pin, as from the bus pirate to the device? (Like TDO - TDO, TDI - TDI...etc etc for all of them). Years ago, I used uart but, I'm not seeing those connections on the board I'm trying to mess around with. I just can't seem to find a guide / tutorial that explains how to set it up, for newbs.

[gmorb]

Is this process just dumping the spi firmware? So i have xgecu on hand i can just read it straight from the rom instead of waiting 5 hours through jtag, correct?

[gabrielsennheiser]

I'd like to see a tutorial using the rasberry pi gpio pins and openocd to say recover a bricked netgear n900 (wndr4500v1/2)

[ManWrenching]

Could this be used to get a proprietary boot loader out of a chip? Like say, the Teensy 3.2?

[myramgrand]

He is so engaging and real! Great presentation!

[antoniosegura]

Great teacher, cfe mac generator for back to the life a dead wrt, im lost the original firmwares, v2, im looking for a cfe bootloader generator to match with generic original firmware, any clue?, and many thanks

[FennecTECH]

God i love WRT54G routers. I was sad when i smoked mine :(

[coondogtheman]

I'd be curious as to the processing power of these things and if any type of software can be run on them. Maybe games.

[juniorlucival]

? when the software don't have chip information ? how will identify the parameters?

[samsamuels]

Hi joe do you have a course i have another tipe of Device the metros will work?

[rikvermeer]

What would be a way to use JTAG to learn about the devices' internal serial communication? Could you point me in a direction?