blueTag (JTAGulator alternative) port to Bus Pirate

Thanks! :slight_smile:

Unfortunately, the excitement was short-lived. Someone reported an issue where the firmware booted straight into CMSIS-DAP mode without anything connected to the corresponding boot mode GPIO. They were using a Pico W, whereas I tested my code on a regular Pico, RP2040-Zero, and a USB-C clone (which has a reset pin :metal: —so much better for development), all without issues. Turns out GPIO29 is configured differently across dev boards. Fixing that uncovered another issue with the UART implementation.

The code is still available, but I’ve deleted the release. I checked out the Bus Pirate port source—moving everything into a struct is definitely a better approach. Once I address the initial bugs and push the release, the focus will be on cleaning up the project. The goal is to keep it closely aligned with the Bus Pirate port’s format so future bug fixes and improvements can be merged more easily. Since I barely get time to work on this during the week, it’s going to take a while. :slightly_smiling_face:

2 Likes

v2.1.0 is live. Should be stable with no major issues :slight_smile: Taking a break for now, but I’ll check in next when I start aligning the code with Bus Pirate. Thanks, everyone, for the positive and helpful discussions!

3 Likes

Congratulations on the updated release!

Please let me know if I can be of help reworking any code.

1 Like

I’m just now getting into the whole hardware hacking thing, and it seems I missed out on the JTAGulator. The only place I can find it is knock off Chinese sites. I’m very interested in the Bus Pirate 6 as an alternative. Do you foresee there being future hardware changes that I should wait for, or is it in a stable state now? I have some logic level shifters on the way from Aliexpress to play around with blueTag on a Pico for now.

1 Like

The BusPirate5 is the standard, and does (nearly) everything well. The only gotcha relates to the FALA (Follow Along Logic Analyzer) when you want to trace the BusPirate’s own outputs also (it’s fine for inputs), and even that is good enough 95% of the time.

BusPirate6 is sort of a luxury version (or in car terms, the premium trim level), stock might be available, and it’s higher priced (due primarily to higher BOM costs). For now, I’m not aware of any features exclusive to the BP6, except that the FALA can accurately trace the buspirate outputs in all cases.

Unless you know you need a BP6, BP5 is a great price / performance mix. If you do someday need a BP6 feature, all the planks / cables you bought for the BP5 will still work on the BP6 … so the upgrade will only be the BP6 unit (and not the accessories) … Love it!

3 Likes

I didn’t know jtagulator was not in current production from Joe.

Bluetag is great, try it on a pico. That might suit your needs. The Bus Pirate has buffers and programmable power supply and some other nice treats that make it a posh experence. We’re working on leveling up the power and ground pin detection using some of the Bus Pirate hardware as well. Bluetag also finds SWD, which I’m not sure jtagulator does.

@Dreg is running a hacker training with BP6, so they will be unobtainum soon. BP5 is as cheap as we can get at our volume and is probably available from an awesome distributor near you. It’s the go to, and supports almost everything possible.

2 Likes

Yup. Joe is not currently selling the JTAGulator. Officially, he says (Oct 2024):

The JTAGulator might be officially manufactured again in the future with a different team, but that’s still in the works so don’t hold your breath!

It is open source, and you can get clones with Joe’s blessing, or get a bare PCB board and make your own. There’s a BOM to make it easy, but there are several posts about people making their own and having problems. Joe has posted some videos to help you in debugging, but he can’t support non-official boards.

One part that is hard to get is the mini-USB connector, as they are obsolete.

I see several JTagulators on eBay. There is at least one US-based clone maker with a 100% reputation.

1 Like

Jtagulator uses parallax chips and spin?

We could rework the PCB for them and do small volume production.

I’d rather figure out what bluetag lacks and push that upstream because the code is pretty universal and will work on most chips.

Yes. Only Windows is supported. No Linux. The big advantage of the JTAGulator is the number of pins it could test in one pass (which might take a long long time)…

1 Like

Blue tag could be sped up using PIO, but then it wouldn’t be useful outside RP2xxx land.

Yeah, it would also be a while until we have a chip that would support that many buffered pins.

If the 8 pins from the BusPirate aren’t enough for JTAG detection, I’d suggest to go a different route instead and use the Glasgow: Introduction - Glasgow Interface Explorer It is based on an FPGA with 16 pins buffered with 1T45’s and gateware that is quite good at JTAG detection.

The concept of the Glasgow allows for bigger devices with even more pins, but these aren’t available to buy yet.

2 Likes

you can use any hirose mini usb there, that doesn’t matter, built my own.

1 Like

i have one of the glasgow, they are good devices, support is not fully there in some areas, its a real work your own applet, modify as needed. its a really piece of work if you want to do some interesting things with ram chips etc.

a few links:

i honestly use the buspirate, hydrabus, jtagulator and more than anything tigard.

so i used a samsung evo840 to get to the jtag. i used my jtagulator 0-7 pins, i also used hydrabus to brute idcode 6…pins, and i have been trying to get bluetag to work with 7 pins. with jtagulator, the voltage was set at 1.8v which is what you would want for this mcu, with hydrabus i didn’t have to do anything but it took a few tries to get the right pin combos right but i compared to jtagulator which is my go to. just putting the output here for comparison but the pinout on hydrabus is not like the pinout on jtagulator.

jtag1> brute bypass 6
Bruteforce on 6 pins.
TMS:PB1 TCK:PB2 TDI:PB0 TDO:PB3 TRST:Unused
TRST: PB4
TRST: PB5

Anything you all want me to try? I tried activating and deactivating the pin pulsing.

----Update----

I added back in the pin i know to be trst and its not used because you have to short pin 6 and 7 on mysetup to do a reset.
hydrabus

TMS:PB3 TCK:PB2 TDI:PB1 TDO:PB0 TRST:Unused
jtag1> bypass
Number of devices found : 1
jtag1> idcode
Device found. IDCODE : 4BA00477

2 Likes

So with the Samsung EVO840 blueTag isn’t able to locate the pins?

Is there any chance you have a logic analyzer trace of what is going on?

If you place probes only on the known pins (instead of 0-7) is it able to locate the jtag interface?

Yes, I get what you are hinting at, writing your own Glasgow applet with gateware for a new protocol is a bit more involved.

But testing for unkown JTAG pinouts and identifying them is something Glasgow has a dedicated applet for: jtag_pinout

So to get the JTAGulator features on a Glasgow you don’t need to write any new code, but just use the existing applet it comes with.

2 Likes

I will get you both later tonight. Basicallys with the evo840 board, you use a sata connector with two ports, one that has data and power and one that has power. amazon search - Dual USB 2.0 to Sata Converter Adapter Cord

Once you power it up you can identify the jtag pins, This is a rather long document linked below but since this is the one thing I had sitting on my desk that I was working on and off on, I was using it for tests.

I will drop a logic analyzer trace. I was doing power traces with the joulescope on it to make sure I could see the upswing in the current.

3 Likes

yes, your right. if you want another multitool that will be expandable later instead of a one off jtagulator that is good at one thing then your totally right. But that is why I am here on this forum, to test out the original multitool and help out. I like all the tools though, electronics are hard.

3 Likes

Hi @rce_pirate,

I have seen blueTag fail in some cases when the TRST pin is also connected to one of the channels. This was addressed in v2.0.0 release.

With the previous version of blueTag (<2.0.0) it usually succeeded if the TRST pin was left unconnected. Can you give that a try since I believe the the port of Bus Pirate is based on blueTag v1.0.2 ?

If it works, then this should be fully addressed in the near future.

4 Likes

that makes total sense in a way as hydrabus was having the same thing when I positioned 6 vs 7 pins in my testing, then you would see TMS change in it. When I left them all connected that was when I got the correct output from that tool. I will test later tonight.

2 Likes