first impressions of the Lego smart brick, before I do any actual tearing down: wow, I forgot how good they are at working with plastic.

[whitequark@social.treehouse.systems]

@lenary no, just normal lego brick shape

[sounddrill@infosec.exchange]

@whitequark I know this seems like an ordinary jump to you but if I managed to get one as clean as this, I'd feel like a goddamn hero

I ruined a beautiful rf01(one of those xbox 360 donor rf recievers wired through usb) with my soldering

Then it died but I think that was because I wasn't supplying the right power the right way(iirc it wanted a stable 3.3v and I just gave it a nodemcu 3v3) which was a common problem on these boards

[whitequark@social.treehouse.systems]

@sounddrill if you're in the area I can teach you how to do it as cleanly as this. nothing special about it

[arclight@oldbytes.space]

@whitequark This is wonderful

[whitequark@social.treehouse.systems]

@triplef that would have to involve the totally undocumented ASIC

[whitequark@social.treehouse.systems]

@triplef honestly the easiest way would be to join LEGO and get all the docs. I probably could do this if I wanted

[sounddrill@infosec.exchange]

@whitequark I'm way out in South India but hey, thanks!

I first learned basics of PCB design years ago over a discord server so I'll be sure to ask if I need to pick something up

[ldcd@social.treehouse.systems]

@whitequark yup i only mention because TMSC (GPIO11) and TCKC (GPIO10) both go straight to vias (and then maybe to the array of testpoints on the back?); Wheras TDO (GPIO9) seems to go to the flash and TDI (GPIO8) seems to go ??.

So I was thinking there's a chance they might be explicitly configuring it as cJTAG and using it for a boundary scan test after manufacture.

[ldcd@social.treehouse.systems]

@whitequark if the REd schematic is to believed TCKC goes only to a testpoint

[whitequark@social.treehouse.systems]

@ldcd hm it's possible but i haven't implemented cJTAG yet so can't easily test

[ldcd@social.treehouse.systems]

@whitequark yeah it's a PITA I was trying to bring up a CC1354 and just could not get it to respond

[whitequark@social.treehouse.systems]

@ldcd welp

[ldcd@social.treehouse.systems]

@whitequark in theory you can use openocd to wake it up and switch it to 4 wire mode but thats also not very fun;

in the TI parts the GPIO mux is subordinate to the JTAG TAP so if you wake up 4 wire mode it takes over the other two pins no matter what the GPIO mux is set to afaict

[maehw@chaos.social]

@whitequark Just in case this were really the end... would you give away your PCB in the state it is right now? And maybe some advice how to dump it? I guess you mean the configuration mode thingie?

[whitequark@social.treehouse.systems]

@maehw I am open to giving it away; I might consider doing a little bit more of RE work e.g. to probe if maybe the LEGO ASIC has a JTAG port available

[maehw@chaos.social]

@whitequark I won't stop you doing more RE'ing! Just curious if the internal flash could still be dumped and before it goes to the trash. Even though I may be lacking the skills to do so.

[ppxl@social.tchncs.de]

@whitequark Monkey Island Q-tip comes to mind

[whitequark@social.treehouse.systems]

@maehw ah I don't trash boards like that unless I 100% know there's nothing more to be gained from them

[revk@toot.me.uk]

@sounddrill @whitequark you need MacGyver, a paperclip and two elastic bands, clearly… This is the closest I could find to an appropriate MacGyver picture…

[magnetic_tape@infosec.exchange]

@whitequark
How did you guess these GPIO would be JTAG?

EDIT: explained further down the thread --> https://social.treehouse.systems/@whitequark/116389802932543329