# Jtagprobe

Probe IoT/embedded targets for exposed SWD/JTAG debug interfaces using a SEGGER J-Link.

- Repository: https://github.com/BrownFineSecurity/iothackbot (879 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-06-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BrownFineSecurity/iothackbot --skill jtagprobe -g -a claude-code -y`
Codex: `npx skills add BrownFineSecurity/iothackbot --skill jtagprobe -g -a codex -y`
Cursor: `npx skills add BrownFineSecurity/iothackbot --skill jtagprobe -g -a cursor -y`
Gemini CLI: `npx skills add BrownFineSecurity/iothackbot --skill jtagprobe -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add BrownFineSecurity/iothackbot`

## Description

Probe IoT/embedded targets for exposed SWD/JTAG debug interfaces using a SEGGER J-Link. Detects whether debug is OPEN, LOCKED (readout-protected), or DEAD (fused off). Use when assessing whether a target's on-chip debug port can be reached, identifying the silicon vendor from DPIDR/IDCODE, and confirming halt+memory access for full debugger control.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Jtagprobe, SWD/JTAG Debug Interface Tester

You are helping the user determine whether a target's on-chip debug interface is exposed via SWD or JTAG, using the `jtagprobe` tool. This drives a SEGGER J-Link physically wired to the target.

## What the tool tests

Three nested access layers are checked, and the target is classified into one of:

- `OPEN`, DP responds, CPU halts, memory reads return plausible data. Full debugger control. Critical finding.
- `LOCKED`, DP/IDCODE accessible but memory reads fail or return readout-protection sentinels (0xFFFFFFFF). Indicates STM32 RDP, NXP CRP, Nordic APPROTECT, etc. are engaged. Still a finding, the port should not respond at all in production.
- `DEAD`, No DP/IDCODE response on any tested interface/speed. Debug fused off, pins not wired, or wrong target.

## Prerequisites

- A SEGGER J-Link (any variant) connected via USB
- `JLinkExe` on PATH, verify with `which JLinkExe`. If it is installed but not on PATH, point the tool at it with `--jlink-binary /path/to/JLinkExe` instead of relying on PATH.
- Target wired to the J-Link 20-pin (or 10-pin Cortex Debug) header. Confirm SWDIO/SWCLK or TDI/TDO/TMS/TCK identification before energizing the target.

If `JLinkExe` cannot be found at all, tell the user to install SEGGER J-Link software from segger.com. Do not attempt to install it without explicit approval.

## Basic usage

Default, sweep SWD then JTAG at 4000/1000/100 kHz, halt, read memory, classify:
```bash
jtagprobe
```

Save per-attempt JLinkExe logs as evidence (recommended for pentest writeups):
```bash
jtagprobe --evidence-dir ./evidence/jtagprobe-$(date +%Y%m%d-%H%M%S)
```

JSON for chaining:
```bash
jtagprobe --format json
```

## Common workflows

### 1. Unknown target, unknown protocol

The rest: https://github.com/BrownFineSecurity/iothackbot/blob/HEAD/skills/jtagprobe/SKILL.md