Jtagprobe, SWD/JTAG Debug Interface Tester

You are helping the user determine whether a target's on-chip debug interface is exposed via SWD or JTAG, using the jtagprobe tool. This drives a SEGGER J-Link physically wired to the target.

What the tool tests

Three nested access layers are checked, and the target is classified into one of:

• OPEN, DP responds, CPU halts, memory reads return plausible data. Full debugger control. Critical finding.
• LOCKED, DP/IDCODE accessible but memory reads fail or return readout-protection sentinels (0xFFFFFFFF). Indicates STM32 RDP, NXP CRP, Nordic APPROTECT, etc. are engaged. Still a finding, the port should not respond at all in production.
• DEAD, No DP/IDCODE response on any tested interface/speed. Debug fused off, pins not wired, or wrong target.

Prerequisites

• A SEGGER J-Link (any variant) connected via USB
• JLinkExe on PATH, verify with which JLinkExe. If it is installed but not on PATH, point the tool at it with --jlink-binary /path/to/JLinkExe instead of relying on PATH.
• Target wired to the J-Link 20-pin (or 10-pin Cortex Debug) header. Confirm SWDIO/SWCLK or TDI/TDO/TMS/TCK identification before energizing the target.

If JLinkExe cannot be found at all, tell the user to install SEGGER J-Link software from segger.com. Do not attempt to install it without explicit approval.

Basic usage

Default, sweep SWD then JTAG at 4000/1000/100 kHz, halt, read memory, classify:

jtagprobe

Save per-attempt JLinkExe logs as evidence (recommended for pentest writeups):

jtagprobe --evidence-dir ./evidence/jtagprobe-$(date +%Y%m%d-%H%M%S)

JSON for chaining:

jtagprobe --format json

Common workflows

1. Unknown target, unknown protocol