ESP32 JTAG Debugging can be done through a MicroSD Card Socket

Found in most microcontrollers and processors, JTAG is an industry standard for verifying designs and testing printed circuit boards after manufacture, and that is also often used for low-level debugging or reverse-engineering.

Espressif ESP32 also has a JTAG interface, but interestingly it’s shared with the SD card interface, and in ESP32 LyRaT audio development board where both MicroSD card slot and JTAG header are present selection is made by jumpers.

ESP32 shared SD card & JTAG signals

The extract from ESP32 LyRaT schematics above shows IO’s 12, 13, 14 and 15 can present on the SD card and 4-pin JTAG header. Some boards may not come with a JTAG header but may feature a MicroSD card slot, but you don’t have to solder wires to the board to access JTAG, and instead, you could simply use a custom MicroSD card adapter to insert into the MicroSD card socket of the board and access JTAG as explained by cibomahto on Twitter.

ESP32 JTAG MicroSD Card Adapter

Nice little hardware trick! The photo below shows what it looks like when an ESP32 board is connected to a “JTAG debugger” (actually ESP32-Ethernet-Kit development board with FTDI chip). If your board comes with a full-sized SD card socket using a standard MicroSD to SD adapter should work too.

ESP32 JTAG via Micro SD Card
Click to Enlarge

Reading comments on Twitter also informs use ESP32 is not the first platform with this trick, as (some?) Allwinner processors also route JTAG signals via the SD card interface.

Share this:
FacebookTwitterHacker NewsSlashdotRedditLinkedInPinterestFlipboardMeWeLineEmailShare

Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress

ROCK 5 ITX Rockchip RK3588 mini-ITX motherboard

15 Replies to “ESP32 JTAG Debugging can be done through a MicroSD Card Socket”

      1. Actually EspressIF patched the vulnerability in ESP32-D0WD-V3 chips and the related ESP32-WROVER-E module. But yes, all older chips are pwned. So the “forever” part is subjective 🙂

        1. As you’ve written, this stands for the new chips only. Therefore, the authors claim is not wrong and it means that the affected chips cannot be fixed, so they’ll have this issue permanently.

          That doesn’t include other HW and it’s great that it got fixed and it was pity for the damages that the company had because of the previous affected versions.

    1. The microSD adapter in linux-sunxi website is quite nice since no soldering is required. I can’t quite find this exact model anymore.

      Edit: Yes, it’s still for sale. See Zoobab comment

  1. Another solution might consist in using HardKernel/FriendlyElec’s eMMC to uSD adapters and to either solder directly on the adapter or use a cable.

  2. the JTAG for microsd you can change the GB expansion example micro sd from 128gb and it changes to 512gb you can Sorry I’m new to these technologies but I’m curious to find out.

Leave a Reply

Your email address will not be published. Required fields are marked *

Boardcon Rockchip RK3588S SBC with 8K, WiFI 6, 4G LTE, NVME SSD, HDMI 2.1...
Boardcon Rockchip RK3588S SBC with 8K, WiFI 6, 4G LTE, NVME SSD, HDMI 2.1...