Hardware debug-interface triage (UART / JTAG / SWD)

When it applies

You have physical access to a device you own or are explicitly authorized to open — a router, IoT gadget, embedded controller, or a board pulled from a larger system — and you need console access or a firmware image. Hardware work is governed by the same envelope as everything else: load tradecraft-scope-roe first and confirm the physical device and the teardown itself are in scope.txt. Never open or probe a device that isn't yours or in writing.

Why it works

Vendors leave debug and factory-test interfaces on the board: a UART serial console for boot logs (often a root shell), and JTAG/SWD for chip-level debugging and memory readout. These ports bypass all software authentication on the running system — if you can electrically reach them and match the logic levels, the device talks to you. Bootloader consoles (U-Boot) additionally let you alter boot arguments or read flash before the OS locks anything down.