ESP32 JTAG Debugging can be done through a MicroSD Card Socket

Found in most microcontrollers and processors, JTAG is an industry standard for verifying designs and testing printed circuit boards after manufacture, and that is also often used for low-level debugging or reverse-engineering.

Espressif ESP32 also has a JTAG interface, but interestingly it’s shared with the SD card interface, and in ESP32 LyRaT audio development board where both MicroSD card slot and JTAG header are present selection is made by jumpers.

The extract from ESP32 LyRaT schematics above shows IO’s 12, 13, 14 and 15 can present on the SD card and 4-pin JTAG header. Some boards may not come with a JTAG header but may feature a MicroSD card slot, but you don’t have to solder wires to the board to access JTAG, and instead, you could simply use a custom MicroSD card adapter to insert into the MicroSD card socket of the board and access JTAG as explained by cibomahto on Twitter.

Nice little hardware trick! The photo below shows what it looks like when an ESP32 board is connected to a “JTAG debugger” (actually ESP32-Ethernet-Kit development board with FTDI chip). If your board comes with a full-sized SD card socket using a standard MicroSD to SD adapter should work too.

Click to Enlarge

Reading comments on Twitter also informs use ESP32 is not the first platform with this trick, as (some?) Allwinner processors also route JTAG signals via the SD card interface.

Support CNX Software - Donate via PayPal, become a Patron on Patreon, or buy review samples
Subscribe
Notify of
guest
15 Comments
oldest
newest most voted
dimtass
8 months ago

I think that this step doesn’t really matter anymore since (as the author of the original post said) ESP32 is pwn forever.

https://limitedresults.com/2019/11/pwn-the-esp32-forever-flash-encryption-and-sec-boot-keys-extraction/

Lembitu Ling
7 months ago

Actually EspressIF patched the vulnerability in ESP32-D0WD-V3 chips and the related ESP32-WROVER-E module. But yes, all older chips are pwned. So the “forever” part is subjective 🙂

dimtass
7 months ago

As you’ve written, this stands for the new chips only. Therefore, the authors claim is not wrong and it means that the affected chips cannot be fixed, so they’ll have this issue permanently.

That doesn’t include other HW and it’s great that it got fixed and it was pity for the damages that the company had because of the previous affected versions.

guest
guest
8 months ago

You can get these on AliExpress for $5. Has JTAG and serial console breakouts. Look for ‘uSD breakout board’.
Serrial console works for AllWinner (RX/TX = D3/CLK) and Amlogic (RX/TX = D2/D3), too. Dunno about JTAG.
This is what these breakout boards look like: https://linux-sunxi.org/MicroSD_Breakout

Peter
Peter
8 months ago

Amlogic also have official SDIO debug board which uses some secret sauce 🙂

comment image

Philipp Blum
Philipp Blum
8 months ago

Thanks. This is really interesting. I got some Allwinner Boards.

roel
roel
8 months ago

Where can you find such a custom MicroSD card adapter?

zoobab
8 months ago

“as (some?) Allwinner processors also route JTAG signals via the SD card interface.”

Remember the Allwinner A10 JTAG SD card breakout:

https://fr.aliexpress.com/item/527673076.html

Philipp Blum
Philipp Blum
8 months ago

Yeahh… “Sorry, this item is no longer available!”
Too many people bought it ^^ 😀

David Willmore
David Willmore
8 months ago

Don’t a bunch of allwinner tablets route the debugging UART to the micro-SD slot?

willy
willy
8 months ago

Another solution might consist in using HardKernel/FriendlyElec’s eMMC to uSD adapters and to either solder directly on the adapter or use a cable.

Ricky
8 months ago

the JTAG for microsd you can change the GB expansion example micro sd from 128gb and it changes to 512gb you can Sorry I’m new to these technologies but I’m curious to find out.

Advertisements