# Phantom JTAG — Solution

## Overview

Simulated JTAG debug port with IEEE 1149.1 TAP state machine. The debug interface is locked and requires a key to unlock. Once unlocked, memory can be read to extract the flag.

## Steps

1. Connect:

```bash
nc <host> 3400
```

2. Reset the TAP controller:

```
reset
```

3. Read device IDCODE:

```
ir 1
dr 00000000 32
```

Returns `0x4BA00477` (ARM Cortex-M like device).

4. Unlock debug interface — load IR instruction 0x5 and send key `0xDEAD`:

```
ir 5
dr DEAD 16
```

Check with `state` — should show "Debug: UNLOCKED".

5. Read memory — load MEM_READ instruction (IR 0x8):

```
ir 8
```

6. Dump flag from memory at 0x1000:

```
dr 1000 16
dr 00000000 32
```

The first `dr` sends the address, the second reads the 32-bit word at that address. Repeat for addresses 0x1000, 0x1004, 0x1008... until the full flag is recovered.

7. Convert the 32-bit little-endian words back to ASCII to reconstruct the flag.

## Key Concepts

- **JTAG TAP state machine**: IEEE 1149.1 defines a 16-state FSM controlled by TMS signal
- **IR/DR registers**: Instruction Register selects the operation, Data Register carries parameters/results
- **Debug port locking**: Many chips have a lock mechanism requiring a key to enable debug access
- **Memory dump via JTAG**: Once debug is unlocked, arbitrary memory reads are possible
