first impressions of the Lego smart brick, before I do any actual tearing down: wow, I forgot how good they are at working with plastic.

[whitequark@social.treehouse.systems]

@triplef that would have to involve the totally undocumented ASIC

[whitequark@social.treehouse.systems]

@triplef honestly the easiest way would be to join LEGO and get all the docs. I probably could do this if I wanted

[sounddrill@infosec.exchange]

@whitequark I'm way out in South India but hey, thanks!

I first learned basics of PCB design years ago over a discord server so I'll be sure to ask if I need to pick something up

[ldcd@social.treehouse.systems]

@whitequark yup i only mention because TMSC (GPIO11) and TCKC (GPIO10) both go straight to vias (and then maybe to the array of testpoints on the back?); Wheras TDO (GPIO9) seems to go to the flash and TDI (GPIO8) seems to go ??.

So I was thinking there's a chance they might be explicitly configuring it as cJTAG and using it for a boundary scan test after manufacture.

[ldcd@social.treehouse.systems]

@whitequark if the REd schematic is to believed TCKC goes only to a testpoint

[whitequark@social.treehouse.systems]

@ldcd hm it's possible but i haven't implemented cJTAG yet so can't easily test

[ldcd@social.treehouse.systems]

@whitequark yeah it's a PITA I was trying to bring up a CC1354 and just could not get it to respond

[whitequark@social.treehouse.systems]

@ldcd welp

[ldcd@social.treehouse.systems]

@whitequark in theory you can use openocd to wake it up and switch it to 4 wire mode but thats also not very fun;

in the TI parts the GPIO mux is subordinate to the JTAG TAP so if you wake up 4 wire mode it takes over the other two pins no matter what the GPIO mux is set to afaict

[maehw@chaos.social]

@whitequark Just in case this were really the end... would you give away your PCB in the state it is right now? And maybe some advice how to dump it? I guess you mean the configuration mode thingie?

[whitequark@social.treehouse.systems]

@maehw I am open to giving it away; I might consider doing a little bit more of RE work e.g. to probe if maybe the LEGO ASIC has a JTAG port available

[maehw@chaos.social]

@whitequark I won't stop you doing more RE'ing! Just curious if the internal flash could still be dumped and before it goes to the trash. Even though I may be lacking the skills to do so.

[ppxl@social.tchncs.de]

@whitequark Monkey Island Q-tip comes to mind

[whitequark@social.treehouse.systems]

@maehw ah I don't trash boards like that unless I 100% know there's nothing more to be gained from them

[revk@toot.me.uk]

@sounddrill @whitequark you need MacGyver, a paperclip and two elastic bands, clearly… This is the closest I could find to an appropriate MacGyver picture…

[magnetic_tape@infosec.exchange]

@whitequark
How did you guess these GPIO would be JTAG?

EDIT: explained further down the thread --> https://social.treehouse.systems/@whitequark/116389802932543329

[at@mathstodon.xyz]

@whitequark @pdo

[novet@infosec.exchange]

@whitequark @drwho oh boy i want one so bad, shame i don't have the time of day to use it though

[maehw@chaos.social]

@whitequark Just in case, others want to dig deeper: I cut out the binary starting from offset 0x105000 and can confirm, that I can parse the unencrypted, uncompressed read-only file system (ROFS) there:

https://codeberg.org/maehw/SmartBrickToolkit/src/branch/main/kaitai/smart_brick_decompressed_rofs_segment.ksy + other parts in the repo

I guess that the remaining parts are meta data... and probably also diagnostic data which are collected by the brick and may be transmitted to TLG via their companion app.

[maehw@chaos.social]

@whitequark Help in finding checksum or hash algorithms... timestamps or whatsoever in the data structure is more then welcome. Happy to get pull aka merge requests on Codeberg.