2021-12-31 18:04:05 +08:00
# Notes on JTAG
< a id = "top" > < / a >
2019-07-29 01:41:45 +08:00
Some notes on how to reflash a bricked Proxmark3 over JTAG.
2021-12-31 18:04:05 +08:00
# Table of Contents
- [Notes on JTAG ](#notes-on-jtag )
- [Table of Contents ](#table-of-contents )
- [Linux and OpenOCD ](#linux-and-openocd )
- [Using RDV4 scripts ](#using-rdv4-scripts )
- [RDV4 pinout ](#rdv4-pinout )
- [JLink pinout ](#jlink-pinout )
- [Raspberry Pi pinout ](#raspberry-pi-pinout )
- [Where to find more information? ](#where-to-find-more-information )
- [Third party notes on using a BusPirate ](#third-party-notes-on-using-a-buspirate )
- [Third party notes on using a J-Link ](#third-party-notes-on-using-a-j-link )
- [Third party notes on using a RaspBerry Pi ](#third-party-notes-on-using-a-raspberry-pi )
- [Third party notes on using a J-Link on Windows ](#third-party-notes-on-using-a-j-link-on-windows )
- [Stack Overflow write up article. ](#stack-overflow-write-up-article )
- [Old original docs ](#old-original-docs )
2019-07-29 01:41:45 +08:00
# Linux and OpenOCD
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
## Using RDV4 scripts
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
The RDV4 repository contains helper scripts for JTAG flashing.
* Get OpenOCD, e.g.: `apt-get install openocd`
* Create `tools/jtag_openocd/openocd_configuration` by copying [`tools/jtag_openocd/openocd_configuration.sample` ](/tools/jtag_openocd/openocd_configuration.sample )
2021-02-04 21:49:15 +08:00
* Tune it to fit your JTAG tool: adapt `CONFIG_IF` to refer to your JTAG tool. `openocd_configuration.sample` contains several examples and is set up by default to work with the J-Link.
2019-07-29 01:41:45 +08:00
* Wire the Proxmark3 to the JTAG tool. How to do it depends on the tool. See below for examples. **Warning:** don't plug the Proxmark3 on USB if the tool delivers already the voltage to the Proxmark3, which is most probably the case.
* Then just run
```
cd tools/jtag_openocd/
./openocd_flash_recovery.sh
```
In some rare situations, flashing the full image over JTAG may fail but the bootloader could be fixed. If it's the case, you can flash the image without JTAG by booting on your fresh bootloader (possibly forced by pressing the Proxmark3 button).
For advanced usages there are also `openocd_flash_dump.sh` for dumping the content of the Proxmark3 and `openocd_interactive.sh` for an OpenOCD console.
## RDV4 pinout
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
The RDV4 JTAG header is quite smaller compared to other Proxmark3 platforms.
If you're using a J-Link, there is a [convenient adapter ](https://github.com/RfidResearchGroup/proxmark3/wiki/Tools#jtag-adapter ) made by Proxgrind.
2021-02-04 21:49:15 +08:00
You can also make yours with some 1.27mm headers (look for `1.27mm header` on Aliexpress) or Pogo pins or buy an already made clip, e.g. search `dykb clamp` on Aliexpress and take a 1.27mm single-row 6P version.
2019-07-29 01:41:45 +08:00
## JLink pinout
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
J-Link [pinout ](https://www.segger.com/interface-description.html ):
```
--------- ---------
|1917151311 9 7 5 3 1|
|201816141210 8 6 4 2|
--------------------
```
PM3 | JLink
--- | -----
TMS | 7
TDI | 5
TDO |13
TCK | 9
GND | 6
3.3 | 2
## Raspberry Pi pinout
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
RPi [pinout ](https://pinout.xyz/ ):
PM3 | RPi
--- | -----
TMS | 22
TDI | 19
TDO | 21
TCK | 23
GND | 6
3.3 | 1
2021-01-28 06:45:32 +08:00
# Where to find more information?
2021-12-31 18:04:05 +08:00
^[Top](#top)
2021-03-09 19:32:59 +08:00
There has been lots of articles and blogposts about recovering, debricking, JTAG your Proxmark3 and you find here below an assortiment of resources that will be of help.
2021-01-28 06:45:32 +08:00
2019-07-29 01:41:45 +08:00
## Third party notes on using a BusPirate
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
* https://github.com/Proxmark/proxmark3/wiki/Debricking-Proxmark3-with-buspirate
2019-11-28 16:15:03 +08:00
* https://b4cktr4ck2.github.io/De-Brickify-Pm3-RDV2/
* https://scund00r.com/all/rfid/2018/05/18/debrick-proxmark.html
* https://joanbono.github.io/PoC/Flashing_Proxmark3.html
2019-07-29 01:41:45 +08:00
## Third party notes on using a J-Link
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
* http://wiki.yobi.be/wiki/Proxmark
## Third party notes on using a RaspBerry Pi
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
* http://www.lucasoldi.com/2017/01/17/unbrick-proxmark3-with-a-raspberry-pi-and-openocd/
2021-01-13 03:19:00 +08:00
* https://wiki.elvis.science/index.php?title=Proxmark3:_Debricking
* https://github.com/synthetos/PiOCD/wiki/Using-a-Raspberry-Pi-as-a-JTAG-Dongle
2019-07-29 01:41:45 +08:00
## Third party notes on using a J-Link on Windows
2021-12-31 18:04:05 +08:00
^[Top](#top)
2019-07-29 01:41:45 +08:00
* https://github.com/Proxmark/proxmark3/wiki/De-Bricking-Segger
2021-01-13 03:19:00 +08:00
2021-01-14 19:13:39 +08:00
## Stack Overflow write up article.
2021-12-31 18:04:05 +08:00
^[Top](#top)
2021-01-14 19:13:39 +08:00
https://stackoverflow.com/questions/48794076/error-halt-timed-out-wake-up-gdb/64291913#64291913
2021-12-31 18:04:05 +08:00
## Old original docs
^[Top](#top)
2021-01-28 06:45:32 +08:00
Describes the SEGGER JLINK, JTAG process but be warned, this document is old.
https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/original_proxmark3/Compiling%20Proxmark%20source%20and%20firmware%20upgrading%20v1.pdf
