Audit embedded device debug interfaces and extract firmware

This skill performs a physical security review of authorized hardware: it finds and documents exposed debug interfaces (UART, JTAG, SWD), reads boot logs, and assesses boot-interrupt or root-shell exposure. Paired with a teardown, it extracts Flash contents to evaluate the feasibility of secure boot or encrypted flash, preferring non-destructive methods first.

Use it for a physical security review of a device you own or are authorized to test, or to locate and document exposed debug interfaces before handing off to deeper firmware analysis. It requires explicit written authorization and confirmation of scope before any active probing step, and it must never be used to disassemble or damage a device without authorization.

Input is physical access to an authorized device. Output is a set of labeled test-point photographs, identified pin functions (GND/VCC/TX/RX) and logic levels (1.8/3.3/5V), read-only boot logs with the recorded baud rate, a JTAG IDCODE enumeration with a lock-status assessment, and a hashed extracted Flash image ready to hand off to the firmware-pentest or Ghidra skill.

A USB-TTL adapter or logic analyzer reads UART; J-Link or CMSIS-DAP handle JTAG/SWD debugging; a bus pirate or Flipper device (lab use) covers additional protocols; binwalk or flashrom extract the Flash image once access is confirmed.

Hardware and embedded security researchers doing an authorized physical assessment of a device, who then hand the extracted firmware onward to reverse-engineering or firmware-specific analysis rather than working the image cold. It assumes basic hardware tooling and physical access; soldered-down or deliberately disabled debug ports raise the difficulty sharply and may put some targets out of reach non-destructively.