JTAG Port/pinpads on the camera circuit boards ?

linuxGuy

« on: 08 / December / 2007, 13:00:33 »

Advertisements

Canon probably does some assembly line programming and testing. The easiest way to program the camera and test all the camera systems would be through the processor JTAG port. The ARM9 processors have a JTAG debugging system on them, built right into the core.

Has anyone had the circuit board out of a camera and noticed an edge connector, a small 6 to 8 pin JTAG connector or a collection of pad where a "bed of nails" could quickly contact the board to test it ?

Our hacking job would be greatly simplified if we had JTAG access to the processor. I can single step source code and set various breakpoints on other ARM processors using the JTAG port.

Logged

ewavr

1057
A710IS

Re: JTAG Port/pinpads on the camera circuit boards ?

« Reply #1 on: 08 / December / 2007, 13:12:40 »

Canon G7 PCB -http://qman.fotokala.ee/Kaamerad/PowerShotG7/page6.html.

Logged

linuxGuy

Re: JTAG Port/pinpads on the camera circuit boards ?

« Reply #2 on: 08 / December / 2007, 13:48:08 »

Thanks for the link to the images.

I think the 5 pin pads below the processor are the JTAG port.

Why ?
- they are near the processor
- its a surface mount board. Although it could have vias, it would be unlikely to have 5 of them in such close proximity, or be that large
- they are neatly arranged in a 2x3 grid, just like the bed of nails pins would be.

Typically the board will be manufactured (components placed, soldered) and then it will be programmed and tested. My guess is that those 5 pins connect to the JTAG port.

Some ARMs can also be programmed via a serial port. The ARM7 core in the LPC21xx series is done this way. The only thing with that is a serial port is slow compared to the JTAG port and you can't do much testing/debugging with it. My guess is that those pins are the JTAG port.

One could run a small 6 conductor ribbon cable to those pins and solder it on. Run it out through the battery compartment door... ?