Notices by Graham Sutherland / Polynomial (gsuberland@chaos.social), page 3

@manawyrm @ryanc nor I, unfortunately

@ryanc you'd be surprised how often they do fuse off JTAG, even with no firmware signing. it's the minority case where I find a commercial product with JTAG debug enabled and working.

@ryanc if it does have JTAG somewhere and you can find it and identify the pinout, you'll want a knock-off Segger J-Link. cheap one off eBay or AliExpress, don't bother paying them for the real deal, the cheapo ones work identically. I've seen them for less than £20.

whatever you do, don't bother with OpenOCD's BusPirate JTAG thing, it's literally never worked, you'll spend hours and get nowhere, they really need to pull it from the project.

@ryanc I think wq wrote a thing for Glasgow for doing JTAG pinout identification? either that or I dreamed it lol, hard to tell these days

@ryanc @manawyrm looks like the shielding comes off with just two screws? if you can get a photo with the shielding off on that side, might be possible to spot some goodies

@manawyrm @ryanc holding the CPU in reset would not necessarily put the SPI IOs in a hi-Z state though, and I have seen folks kill boards by trying to assert CS and essentially dead-shorting the low-side output FET on the MCU's GPIO across the rails. with sufficient resistance you can avoid that but it requires calculating the necessary value based on the max sink current rating for the chip, and then you have to think about IO thresholds with any existing pull-ups/pull-downs... it gets messy.

@ryanc that requires an ICSP or JTAG header, and may not work if the security config on the chip says no (you can disable everything but boundary scan, for example, which will prevent debug and firmware upload)

@ryanc got an Arduino, ESP8266, or ESP32 board to hand? pretty easy to wire up and write a little program to write to it if your existing tools won't do it.

@ryanc the SPI IOs will still be asserted, they don't go hi-Z.

@ryanc (this is why I always pull the chip. it's a huge pain in the ass to do it in-system and I can't guarantee a good read)

@ryanc wouldn't that just not power the chip, so it won't respond? you won't be able to read it with the DUT powered on as it'll be asserting the SPI signals - best case no bueno, worst case you'll cook the MCU's IOs.

@ryanc yeah might be a full removal job then unfortunately.

@ryanc SOIC-16? interesting. that sounds... not SPI? usually those are SOIC-8. QSPI or something?

@ryanc soldering iron and tweezers, lift the power leg slightly, put paper or kapton tape under it.

@ryanc although I usually just end up lifting the whole chip 'cos by the time I'm breaking out the iron I might as well take it off completely lol

too hung over to read through the AMD microcode vuln thing but lmao at the proof of concept being "we made RDRAND only return 4"

wild to me that I can just go buy ten thousand discretely-useful manufactured objects for the price of a burger

just read a review of some smoked salmon that complained that it tasted "too fishy".

it's FISH

wait hang on it gets funnier

there is also another review by a different person that said it was the best smoked salmon that they've ever had because *other* smoked salmon tastes too fishy, and this one "uses the good hot smoke".

and they rated it 4 stars.

so I have established that:

- it is too fishy
- it is not at all fishy
- uses the good hot smoke
- it is the best
- but not numerically the best