The Hitchhacker's Guide to iPhone Lightning & JTAG Hacking
Thomas Roth (stacksmashing) reverses the proprietary Apple Lightning connector and Tristar chip, building open-source hardware to enable JTAG debugging on iPhones.
Summary
The Hidden Capabilities of Apple's Lightning Connector
Beyond charging and data transfer, Apple's 8-pin Lightning connector contains proprietary multiplexing hardware used for factory diagnostics and low-level serial debugging.
Reverse Engineering the Tristar and Hydra ICs
Thomas Roth analyzes the serial handshake protocol (SDQ) used by the Lightning cable to negotiate multiplexed analog and digital pin assignments.
Building Custom Hardware for JTAG Multiplexing
Roth details designing open-source breakout hardware and firmware to command Tristar into exposing raw hardware JTAG and SWD debug ports.
Unlocking Low-Level Hardware Research on iOS Devices
The presentation provides security researchers with open-source schematics and firmware to inspect baseband and application processors on iPhones.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.
Main Stage·42 min
Mark Omo · James Rowley
Reverse engineers electronic gun safes and commercial digital vaults, demonstrating effortless physical and electromagnetic bypasses across leading brands.