Probe IoT targets for exposed SWD and JTAG debug interfaces using a SEGGER J-Link.
npx skills add https://github.com/BrownFineSecurity/iothackbot --skill jtagprobe
Please help me install this Agent Skill. Skill: jtagprobe Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/skills/jtagprobe Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill jtagprobe
Hardware security testers need to know whether an embedded target's on-chip debug port is exposed, locked, or fused off, but manually driving J-Link sessions and interpreting DPIDR/IDCODE responses is slow and error-prone.
Ask the assistant to test the connected target for exposed JTAG and SWD debug interfaces and save the evidence logs to a timestamped directory.
High-intent search queries and answers about installing and using this skill.
Connect a SEGGER J-Link to the target's debug header and run jtagprobe with default settings. It sweeps SWD then JTAG at multiple clock speeds, halts the CPU, reads memory, and classifies the port as OPEN, LOCKED, or DEAD.
You need a SEGGER J-Link probe connected via USB, JLinkExe installed and on PATH, and the target wired to the J-Link 20-pin or 10-pin Cortex Debug header. Confirm SWDIO/SWCLK or TDI/TDO/TMS/TCK pin identification before powering the target.
LOCKED means the debug port responds with a valid DPIDR or IDCODE but memory reads fail or return 0xFFFFFFFF sentinels. This indicates readout protection such as STM32 RDP, NXP CRP, or Nordic APPROTECT is engaged, though the port itself remains exposed.
Yes, it decodes the JEP106 designer field from DPIDR or IDCODE values to identify vendors such as STMicroelectronics, NXP, Nordic, and TI. Passing --device with a known chip name like STM32F407VG improves halt and memory test accuracy.
No, it requires physical access to the debug header and a wired J-Link probe. It is not a network or pcap-based check, and it does not perform unlock or mass-erase operations, which are destructive and out of scope.
zhinkgitAutomate J-Link probe operations for ARM Cortex-M device flashing and debugging.
vigoliumEscalate suspected authentication bypasses into proven admin access, session takeover, or cross-tenant impact findings.
XerrionIdentify and analyze firmware images to extract bootloaders, root filesystems, and RTOS artifacts.
AgentSecOpsPerform authorized network reconnaissance with Nmap port scanning and service enumeration.
