# Phantom JTAG

| Field | Value |
|-------|-------|
| Category | Hardware |
| Difficulty | Medium-Hard |
| Points | 500 |
| Author | Eun0us |
| CTF | Espilon 2026 |

---

## Description

A JTAG debug port on a WIRED-MED module is partially accessible.
The debug interface is locked, but the TAP controller still responds to state transitions.

Navigate the IEEE 1149.1 state machine, read the device IDCODE, unlock the debug interface,
and extract secrets from memory.

- JTAG Port: `tcp/<host>:3400`

Format: **ESPILON{...}**

---

## TL;DR

Interact with a simulated JTAG TAP controller. Reset the state machine, read the IDCODE via
standard IR instruction 0x1, then send the proprietary unlock instruction (IR=0x5) with key
`0xDEAD`. Once debug is unlocked, use MEM_READ (IR=0x8) to dump memory at 0x1000 and
reassemble the flag.

---

## Tools

| Tool | Purpose |
|------|---------|
| `nc` | Connect to JTAG port |
| Python 3 | Automate IR/DR sequences and decode memory |
| Knowledge of IEEE 1149.1 | Understand TAP state machine |

---

## Solution

### Step 1 — Connect

```bash
nc <host> 3400
```

![JTAG port banner showing TAP controller information](https://git.espilon.net/Eun0us/ESPILON-CTF-2026-Writeups/raw/branch/main/screens/jtag_banner.png)

### Step 2 — Reset the TAP controller

```text
reset
```

The TAP state machine enters Test-Logic-Reset, then shifts to Run-Test/Idle.

### Step 3 — Read device IDCODE

Load IR instruction 0x1 (IDCODE), then shift out the 32-bit DR:

```text
ir 1
dr 00000000 32
```

Returns `0x4BA00477` — an ARM Cortex-M style IDCODE.

![IDCODE read returning 0x4BA00477](https://git.espilon.net/Eun0us/ESPILON-CTF-2026-Writeups/raw/branch/main/screens/jtag_idcode.png)

### Step 4 — Unlock the debug interface

Load the proprietary lock control instruction (IR=0x5) and send the 16-bit unlock key `0xDEAD`:

```text
ir 5
dr DEAD 16
```

Verify:

```text
state
```

Output should now show: `Debug: UNLOCKED`

![state command showing Debug: UNLOCKED](https://git.espilon.net/Eun0us/ESPILON-CTF-2026-Writeups/raw/branch/main/screens/jtag_unlock.png)

### Step 5 — Load the memory read instruction

```text
ir 8
```

### Step 6 — Dump flag from memory

Send address 0x1000 as the first DR, then read back the 32-bit word:

```text
dr 1000 16
dr 00000000 32
```

The second `dr` reads the 32-bit little-endian word at address 0x1000.
Repeat for addresses 0x1004, 0x1008, etc. until the flag is complete.

Convert each little-endian 32-bit word to 4 ASCII bytes and concatenate.

![dr reads returning flag bytes as 32-bit little-endian words](https://git.espilon.net/Eun0us/ESPILON-CTF-2026-Writeups/raw/branch/main/screens/jtag_mem_read.png)

### Key concepts

- **JTAG TAP state machine**: IEEE 1149.1 defines a 16-state FSM controlled by the TMS signal.
  TDI/TDO carry shift register data; TCK clocks transitions.
- **IR/DR registers**: The Instruction Register selects the active operation; the Data Register
  carries parameters and results for that operation.
- **Debug port locking**: Many chips implement a proprietary lock mechanism requiring a secret
  key to enable debug memory access.
- **Memory dump via JTAG**: Once debug is unlocked, arbitrary memory reads become possible —
  a common firmware extraction technique used in hardware security research.

---

## Flag

`ESPILON{jt4g_d3bug_unl0ck3d}`
