Attacking Hardware Interfaces

Physical access changes the game: the debug ports, flash chips, and boot process the vendor assumed were private are all reachable. The work is finding the interfaces on the board, using them to reach a shell or dump the firmware, and judging whether the device's secure-boot and RF designs actually hold. Almost everything here needs the device in hand and permission to open it.

When to Use

• You have physical access to an embedded device or PCB and need to find its debug/serial/flash interfaces
• Getting a UART console or root shell, interrupting a bootloader, or halting the CPU over JTAG/SWD
• Dumping firmware off a SPI/I2C flash chip for analysis
• Triaging a secure-boot / chain-of-trust design for bypass feasibility
• Studying sub-GHz RF replay feasibility (fixed vs rolling code) in a lab

When NOT to Use