June 20, 2021

Bus Blaster

Bus Blaster is a JTAG (and a few others) debugger and thing for slurping firmware off boards with embedded chips on them. It hooks up to your USB and allows you to read stuff off an embedded board. Here’s a picture of one.

In this example, I’ll be working with a super old Linksys WRT54G you can get for dirt cheap. I had to solder some headers on to the board (after I got the case off, which was super weird, just basically pulls apart per YouTube dissasembly video 🙂 So now I have something like this:

Notice I accidentally soldered on another header to the right, but you don’t need that one, just the one on the left. I hooked up the wires based on a pinout I found somewhere on the Internet showing the supposedly correct pinout of the JTAG header on a WRT54G like:

After you have these tiny wires hooked up on the Linksys end, you have to hook them up to your Bus Blaster, here’s what I have:

It’s kind of hard to see which pins go to which, but there’s a label on the bottom of the Bus Blaster board if you want to check.

Now you have to hook up your laptop and probe your device. It’s tricky, because you have to first hook up to the Bus Blaster, then go tell the Bus Blaster to hook up to the WRT54G, but it’s easy to get confused which one you’re talking to. This is because of a thing called the JTAG chain. JTAG chains means JTAG looks for a chain of devices it can connect to, and the first one has to be the Bus Blaster itself.

On your Linux laptop do:

apt install urjtag
jtag> help
shows possible commands
jtag> cable JTAGkey vid=0x0403 pid=0x6010
Connected to libftdi driver.
jtag> detect
IR length: 8
Chain length: 1
Device Id: 00000101001101010010000101111111 (0x0535217F)
  Manufacturer: Broadcom (0x17F)
  Unknown part! (0101001101010010) (/usr/share/urjtag/broadcom/PARTS)

This means the Bus Blaster actually sees the chipset on the WRT54G, which it thinks is a Broadcom 🙂 Don’t worry about the “Unknown part” thing, that doesn’t matter yet.

The vid and pid are the things for the connection to the Bus Blaster itself.