Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
en:reverse-engineering:jtag:start [2013/02/16 08:43] alex [Netlist Extraction] |
en:reverse-engineering:jtag:start [2013/02/16 08:47] alex [Output probing] |
||
|---|---|---|---|
| Line 17: | Line 17: | ||
| The process of netlist extraction is very simple. Turn all the I/O pins to inputs, turn one on, look at all the pins, turn it off, look at all the pins again, and see what changed. Repeat this for every JTAG accessible pin on the board. The jrev tool does this for a parallel port JTAG cable, and the ftjrev tool does this for FTDI based USB jtag cables. However, these tools can only find connections between JTAG enabled pins. | The process of netlist extraction is very simple. Turn all the I/O pins to inputs, turn one on, look at all the pins, turn it off, look at all the pins again, and see what changed. Repeat this for every JTAG accessible pin on the board. The jrev tool does this for a parallel port JTAG cable, and the ftjrev tool does this for FTDI based USB jtag cables. However, these tools can only find connections between JTAG enabled pins. | ||
| - | As the JTAG boundary scan functionality allows for access to the IO pins of the chips, it is possible to probe pins with external signal sources and sinks as well as other JTAG enabled pins. I created an [[http://github.com/alexforencich/ftjrev|ftjrev github repository]] to store the modified ftjrev code as well as the required device definition files. | + | As the JTAG boundary scan functionality allows for access to the IO pins of the chips, it is possible to probe pins with external signal sources and sinks as well as other JTAG enabled pins. I created a [[http://github.com/alexforencich/ftjrev|github repository for ftjrev]] to store the modified code as well as the required device definition files. |
| ===== ftjrev ===== | ===== ftjrev ===== | ||
| Line 136: | Line 136: | ||
| Total boundary scan chain: 8572 | Total boundary scan chain: 8572 | ||
| Clock pass... | Clock pass... | ||
| - | CLOCK: 0[XC5VLX330-FFG1760]:IO_AN14 | ||
| - | CLOCK: 0[XC5VLX330-FFG1760]:IO_J13 | ||
| - | CLOCK: 0[XC5VLX330-FFG1760]:IO_K13 | ||
| - | CLOCK: 1[XC3S1200E-FT256]:IPAD78 | ||
| - | CLOCK: 1[XC3S1200E-FT256]:K2 | ||
| - | CLOCK: 1[XC3S1200E-FT256]:IPAD258 | ||
| - | CLOCK: 1[XC3S1200E-FT256]:L8 | ||
| - | CLOCK: 2[XC5VLX330-FFG1760]:IO_AM13 | ||
| - | CLOCK: 2[XC5VLX330-FFG1760]:IO_J30 | ||
| - | CLOCK: 2[XC5VLX330-FFG1760]:IO_P37 | ||
| Probing outputs, press ctrl+c to stop... | Probing outputs, press ctrl+c to stop... | ||
| </code> | </code> | ||