Extracting Firmware from External Memory via JTAG

[@jimmylim893]

hollyyy.. how in the world only 5000+ people interested in this sort of thing to date...

[@Elfnetdesigns]

the other billions are more interested in Twitter drama and the next new iPhone..

[@jimmylim893]

@@Elfnetdesigns good one... Heart breaking fvcking truth..

[@studyonly9857]

Gthvfrt!!!!!

[@spamlogs2701]

How can u expect someone to wanna watch this crap? Imagine ur grandpa trying to understand this mumbo jumbo.. that’s what 90% of the popular is like when it comes to this. Ur a small niche

[@huhulili9021]

True only 57k + after 3 years, this is a depressing world

[@renakunisaki]

Thank you for explaining every step. It's so frustrating when a tutorial just pulls some information out of their arse without explaining it.

[@sintaklaas6427]

Great content, thanks from Palermo, Sicily

[@HackaweekTV]

Nice one Joe! Good to see you hackin hardware! :) Have a great new year and... KEEP ON HACKIN!

[@usbbdm]

Just in case you do not know, using USB JTAG NT can read the 4M flash under 20 seconds. Not 5 hours. That is too long. Check my videos on routers programming.

[@samuelubina5157]

SO SIR , SHOW US YOUr CHANNEL!!! SO we can be fully inform about this stuff your talking about!!!!

[@1ManWrenching]

Could this be used to get a proprietary boot loader out of a chip? Like say, the Teensy 3.2?

[@TommyAventador]

I wonder if this would work on new iphones to retrieve icloud email?

[@gabrielsennheiser]

I'd like to see a tutorial using the rasberry pi gpio pins and openocd to say recover a bricked netgear n900 (wndr4500v1/2)

[@gmorb666]

Is this process just dumping the spi firmware? So i have xgecu on hand i can just read it straight from the rom instead of waiting 5 hours through jtag, correct?

[@koenigsbier50]

I wish I could upvote this video a thousand times. This is awesome !

[@coondogtheman]

I'd be curious as to the processing power of these things and if any type of software can be run on them. Maybe games.

[@woolfy02]

I just got a bus pirate 3.6a and, I'm wanting to connect to a device using JTAG. The available pins on it are: TDO,TDI,TMS,TCK,GND,RESET Do I just connect it the same named pin, as from the bus pirate to the device? (Like TDO - TDO, TDI - TDI...etc etc for all of them). Years ago, I used uart but, I'm not seeing those connections on the board I'm trying to mess around with. I just can't seem to find a guide / tutorial that explains how to set it up, for newbs.

[@binaryfreaks]

hi joe, I just received my bus blaster v4.1 but I'm experience some issues... can you tell me some tips about it? the error: warning: TDO seems to be stuck at 1

[@rikvermeer1325]

What would be a way to use JTAG to learn about the devices' internal serial communication? Could you point me in a direction?

[@eddyboh2723]

Question, would this work if instead of using a sound blaster adapter, I were to use a small female 20pin to female USB 3.0 output adapter?

[@csabertui]

I'v done a loads of JTAG in the early 2010's sometimes it can be a pain...

[@xl000]

is there a situation where you end up with something similar to a process dump and have to RE some unknow program in order to get the data you're looking for ? I mean grepping / parsing through the output of strings looks relativeley easy, but what if there are defensive contermeasures ? I can imagine ways to protect a private key, but this would always be defeated as the CPU is basically dong what we' re asking it to do. I guess that' s what Apple secure enclase is about

[@FennecTECH]

God i love WRT54G routers. I was sad when i smoked mine :(

[@samsamuels1421]

Hi joe do you have a course i have another tipe of Device the metros will work?

[@juniorlucival]

? when the software don't have chip information ? how will identify the parameters?

[@israelcruz7597]

Why would users not use higher level GUI-based software (Free) to do the same thing with pull-down menus?

[@antoniosegura950]

Great teacher,cfe mac generator for back to the life a dead wrt,im lost the original firmwares,v2,im looking for a cfe bootloader generator to match with generic original firmware,any clue?,and many thanks

[@antoniosegura950]

Im use a usbjtagnt

[@tristunalekzander5608]

I just get "invalid parameter: unknown cable driver 'jtagkey'" ... I have installed the necessary drivers please help and thanks

[@rayfelch954]

That's awesome if you have 'ejtag' support, but what if your target is MIPS32 and your 'initbus ejtag' request gets you 'error: not found EJCONTROL or EJIMPCODE register'? I've tried this on a linksys-wrt54gl v6 router, same exact setup using busblaster with no luck... thanks for your great videos. I love my JTAGULATOR btw

[@Elfnetdesigns]

UGH v6 is the cheapest of the cheap of the WRT54G series... hardly any memory to work with and very limited features. You can barely get DD-WRT on them and they still work sort of stable snd that DD-WRT is a stripped down version designed to fit on the small memory of the v6.. You are better off with a V2 or something in the 802.11N era. 54G was nice 20 years ago but is a dead horse these days..

[@hazromanescconstantin3637]

You can acces data from Arm processor with password protection ?

[@Cotten-]

You are such a great teacher. I wish I could shadow you.

[@jairoripoll1301]

buenas noches como podria conectar launchpad EXP430G2ET A UN CHIP M430F149 VIA JTAP

[@steliosstamatakis844]

can you use jtagulator new features and not busbluster for this?

[@hmbrt12]

Wooooooaaaahhh!!! Thanks!!⚡🤖👌🏼

[@DatamedicsRecovery]

Hi Joe. Any chance you would consider learning how to jtag newer WD HDD PCBs? WD has decided to lock out their PCBs in a way that prevents the normal vendor specific ATA commands from doing things like read/write the ROM code, etc. and it's becoming an issue for data recovery. I know some guys are already unlocking them via jtag, but they are selling their unlocked boards at a crazy markup. The knowledge of how to do this is definitely worth some $$ for me, but I'm no jtag expert. It's knowledge I'd be willing to pay for.

[@shutrumpracing2451]

can you do this on an altera max7000?

[@rahulsethi_]

what if the data shown by string function is encrypted??

[@renakunisaki]

It will always have a lot of false positives, just ignore those.

[@antoniosegura950]

Or how edit cfe mac adress in firmware

[@petejackson7976]

How do you identify where to connect cables from the interface to the target machine?

[@Elfnetdesigns]

datasheets

[@myramgrand]

He is so engaging and real! Great presentation!

[@vondarycrentsil9180]

Can u extract anki robot vector firmware? Pls , and thanks

[@johnpapadopoulos8440]

Nice job. Is it possible to use that jtag for bootloop phone brick? TIA

[@Elfnetdesigns]

you put the wrong firmware in or tried to load a "hacked" firmware and got it in a good ole loop huh? Phones are not worth it once the bootloop, as cheap as they are these days you can buy a brand new tracfone smartphone with service cheaper than you can buy the jtag reader for..

[@tono_01]

@@Elfnetdesigns Your answer seems to be a bit over generalised to me. Phones that are expensive can get bootloop too and it would be interesting to know if you can repair them with this technique.... @John Papadopoulos: In principle, yes you can repair them using this same technique. BUT..... firmware for cellphones require a lot of knowledge if you start poking into them yourself..... They might have encryption that you need to defeat before you can write the code to the device, the more expensive ones (Iphones) do not have JTAG anymore. Or if they do, you need to know very good whoch part of the firmware is for what part of the phone (baseband, phone itself etc.). In my opinion: not an easy task.

[@ddlc7022]

How do you install or set urJTAG for MAC ?

[@ddlc7022]

Joe any comment ?

[@brucelau6929]

Thanks. It helps a lot.

[@zerodegrekelvin2]

Thanks for the demo of poor man Bus Blaster JTAG 8-) I mostly use/loan the BDI2000/3000 from where I worked and I feel pain when you waited 5h to extract 4MB. When I say "poor man" it does not mean pejorative, more of MacGyver compliment.

[@dariadaria9255]

Can someone please tell me best JTAG vendors in market?

[@salmantalash4515]

can we do it in windows

[@Veso266]

how would UrJTAG damage your hardware?

[@309electronics5]

deleting the firmwarw from the device without backup or when an error occurs

[@iitguwahaticseairunder500r2]

You just used this in the recent samsung video!!

[@iitguwahaticseairunder500r2]

To kingpin 👑

[@dillonjensen3728]

Good video!

[@RicardoCooper]

Five hours? Thankfully I have a FlashcatUSB and USBJTAG NOT that can read this much faster! P.S. I already know the pinout but, can the JTAGulator be used with the WRT54G?

[@cocosloan3748]

Cool !

[@sarupk]

thank you!!!!

[@rootcoolk]

Cool Man

[@scanners99]

Creo que Te amo

[@pardal902]

well, today I think 90% of JTag extracting is impossible, all vendors locking it.

[@alexluzinki206]

nice

[@AZ-be4hg]

5hrs to get 'admin' paaswd. Nice work,bro :)

[@MukeshKumar-xi2dj]

hi joegrand wanna some help

[@ThePlombix]

you need a mounain with your name on , youtube is not enought

[@-BILYAKIS-]

in short, Software control Hardware

[@ArnaudMEURET]

Quite fascinating that you pour your money in an Apple laptop where nothing works like everywhere else Unix…😅

[@hamburgermods1396]

yes yes just like the xbox360 jtag

[@mugishastevenyoutubestuden9311]

🖒🖒🖒

[@joshse8709]

U know how I know ur vegan?

[@JTAG123Slamma]

JTAG