re-hardware-io

Extract firmware and debug embedded boards via JTAG, UART, and SPI flash interfaces.

64|9|Updated Aug 17, 2026
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-hardware-io-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-hardware-io
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-hardware-io
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-hardware-io-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When you have a physical embedded device and need to extract its firmware, capture boot logs, or debug the chip, software-only analysis is not enough. This Skill guides safe hardware interfacing—JTAG/SWD debugging, UART serial consoles, SPI flash reading, and logic analyzer capture—while avoiding common board-damaging mistakes. ## Core Features & Use Cases - UART Serial Debugging: Locate TX/RX pins, enumerate baud rates (9600–230400), and capture full boot logs with picocom or minicom. - JTAG/SWD Debugging: Connect with openocd (ST-Link, J-Link, CMSIS-DAP), halt the CPU, read registers, and dump flash banks. - Flash Chip Reading: Read SPI flash offline with flashrom and a ch341a programmer, or on-board via linux_spi, with verification. - Signal Analysis & Pin Discovery: Use sigrok-cli/pulseview logic analyzers to decode UART/SPI and JTAGulator to enumerate unknown pins. - Use Case: You have a router board with no available firmware download. Follow the steps to find the UART test points, capture the boot log, then clip a SOIC8 adapter onto the W25Q128 flash chip and dump the image for unpacking. ## Quick Start Help me connect to this embedded board over UART and dump its SPI flash chip using openocd and flashrom.

Frequently Asked Questions about re-hardware-io

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the UART pins on an unknown circuit board?▼

Inspect the PCB silkscreen for TX/RX/GND labels and use a multimeter to find ground and measure voltage levels. UART TX pins show a square wave pulled high at power-on. A JTAGulator can automatically enumerate UART and JTAG pins on unknown boards.

How do I read an SPI flash chip with flashrom?▼

Power off the board, clip a SOIC8 adapter onto the flash chip matching pin 1 orientation, then run flashrom -p ch341a_spi -r backup.bin with a ch341a programmer. Verify the read with -v and keep the original dump with its sha256 hash.

Why is my serial console output garbled or empty?▼

Garbled output usually means a wrong baud rate or swapped TX/RX wiring. Enumerate common rates starting with 115200 and 9600, ensure TX/RX are crossed and grounds are shared, and use a logic analyzer to measure the actual bit width on the TX line.

What should I do when openocd cannot connect to the target?▼

Connection failures with all-zero IDCODE typically indicate fused JTAG or enabled read protection on production boards. Try the SWD interface instead, use target-specific unlock sequences like stm32f1x unlock, or fall back to UART plus direct flash reading.

Can I connect a 5V USB-UART adapter to a 3.3V board?▼

No, connecting 5V TTL signals to a 3.3V board can permanently damage the interface. Always measure the board's logic level with a multimeter first, use a 3.3V adapter, and add a bidirectional level shifter like TXS0108 for 1.8V or 2.5V targets.

When should hardware extraction be used for firmware analysis?▼

Hardware extraction is the last resort after software methods are exhausted. If you already have a firmware file, unpack it directly; if you need to run it, try emulation first. Only attach to physical hardware when no firmware image is obtainable otherwise.