Hardware Interface Pinout Reference — UART / JTAG / SPI / I2C / ESP32 / Pi
v1.0 // Hylas Security
PROTOCOL OVERVIEW
Quick reference for embedded/hardware protocols encountered during device security testing.
UART — Universal Async Receiver/Transmitter
Serial communication. Most common debug interface on embedded devices. Usually 3.3V. Baud rates: 9600, 115200, 57600, 38400, 19200 most common. Provides root shell access on Linux devices via bootloader interrupt.
TXOUTTransmit — connect to target RX. Typically HIGH (3.3V) when idle.
RXINReceive — connect to target TX. Never connect both TX to TX.
GNDPWRCommon ground. MUST connect before TX/RX.
VCCPWROptional — do NOT power device via VCC unless certain of voltage
JTAG — Joint Test Action Group
Debug/programming interface. 4-wire minimum (TDI/TDO/TCK/TMS) + optional TRST and SRST. Used for firmware extraction, memory dump, live debugging. OpenOCD + JLink/FTDI adapter.
TCKCLKTest Clock — provided by debugger
TMSOUTTest Mode Select — controls TAP state machine
TDIOUTTest Data In — data into device
TDOINTest Data Out — data from device
TRSTOUTTest Reset — optional, active low
SRSTOUTSystem Reset — optional, resets target CPU
SPI — Serial Peripheral Interface
4-wire synchronous. Used for flash memory, displays, sensors. Common for firmware extraction from SPI NOR/NAND flash (25QXX series). Flashrom + CH341A programmer.
SCLK/CLKCLKClock — from master
MOSI/SDIOUTMaster Out Slave In
MISO/SDOINMaster In Slave Out
CS/CEOUTChip Select — active low. One per slave.
I2C — Inter-Integrated Circuit
2-wire synchronous. Shared bus with addressing. Pull-up resistors required (4.7kΩ typical). Logic analyser needed to decode addresses. 7-bit addresses 0x00–0x7F.
SCLCLKSerial Clock — from master
SDAI/OSerial Data — bidirectional, open-drain
UART
⚠ Voltage — most embedded devices use 3.3V UART. Connecting a 5V adapter will damage the device. Measure voltage on TX pin before connecting. Use level shifter for 5V boards.
◆ To identify baud rate: connect to TX only (no RX), capture output in minicom/screen with different baud rates. Correct baud = readable text at boot. Common: 115200, 57600, 38400, 9600.
UART Adapter Wiring (USB → Device)
Adapter→ DeviceNotes
TX→ RXAdapter transmit → Device receive
RX→ TXAdapter receive ← Device transmit
GND→ GNDALWAYS connect GND first
VCC→ —Do NOT connect unless powering device
minicom / screen Commands
LINUX
screen /dev/ttyUSB0 115200Connect at 115200 baud
minicom -D /dev/ttyUSB0 -b 115200
picocom -b 115200 /dev/ttyUSB0
WINDOWS
PuTTY → Serial → COMX → 115200
mode COM3: BAUD=115200 PARITY=n DATA=8CMD check
JTAG
◆ JTAGulator (by Joe Grand) automates JTAG pin identification. Also try JTAGenum Arduino sketch. OpenOCD config files needed for each target — search for target CPU name in OpenOCD source.
20-Pin ARM JTAG (Cortex debug)
Pin 1VCCTarget reference voltage
Pin 2VCCDuplicate VCC
Pin 3TRSTTest Reset (active low)
Pin 4GNDGround
Pin 5TDITest Data In
Pin 6GNDGround
Pin 7TMSTest Mode Select
Pin 8GNDGround
Pin 9TCKTest Clock
Pin 10GNDGround
Pin 13TDOTest Data Out
Pin 15SRSTSystem Reset
SWD — Serial Wire Debug (ARM Cortex)
VCCVCC3.3V reference (do not power from here)
SWCLKTCKSerial Wire Clock
SWDIOTMSSerial Wire Data I/O
SWOTDOSerial Wire Output — optional trace
RESETSRSTOptional reset pin
GNDGNDGround
2-wire only required: SWCLK + SWDIO + GND
ESP32-S3
Key GPIO assignments. Exact pins vary by board (DevKitC vs Waveshare AMOLED vs Baguette S3 etc) — always cross-reference schematic. Strapping pins must be correct at boot.
◆ UART0 (GPIO43=TX, GPIO44=RX) is default debug UART. USB-OTG on GPIO19/20 for native CDC. I2C/SPI are configurable to almost any GPIO.
UART (ESP32-S3)
GPIO43UART0 TXDefault debug TX (3.3V)
GPIO44UART0 RXDefault debug RX
GPIO17UART1 TXConfigurable
GPIO18UART1 RXConfigurable
SPI (ESP32-S3 default)
GPIO11FSPI CLKSPI2 Clock
GPIO13FSPI MOSISPI2 MOSI
GPIO12FSPI MISOSPI2 MISO
GPIO10FSPI CS0SPI2 CS
I2C (ESP32-S3 default)
GPIO8I2C SDADefault I2C data
GPIO9I2C SCLDefault I2C clock
Any GPIO configurable via Wire.begin(SDA,SCL)
Strapping Pins (ESP32-S3)
GPIO0BOOTLOW = download mode, HIGH = normal boot
GPIO3JTAGLOW = JTAG enabled
GPIO45VDD_SPIFlash voltage select
GPIO46ROM logLOW = ROM log disabled
RASPBERRY PI PICO W
RP2040 based. 3.3V I/O. USB device on pin 47/48. SWD debug on 3-pin header. CircuitPython / MicroPython / Arduino IDE.
UART (Pico W)
GP0 (pin 1)UART0 TX3.3V
GP1 (pin 2)UART0 RX
GP4 (pin 6)UART1 TXAlt UART
GP5 (pin 7)UART1 RXAlt UART
SPI (Pico W)
GP18 (pin 24)SPI0 CLK
GP19 (pin 25)SPI0 MOSITX
GP16 (pin 21)SPI0 MISORX
GP17 (pin 22)SPI0 CSnChip Select
I2C (Pico W)
GP4 (pin 6)I2C0 SDA
GP5 (pin 7)I2C0 SCL
GP2 (pin 4)I2C1 SDAAlt I2C
GP3 (pin 5)I2C1 SCLAlt I2C
Power / SWD (Pico W)
Pin 363V3 OUT3.3V regulated output
Pin 40VBUS5V from USB
Pin 39VSYS1.8–5.5V input
SWDIOSWD DataDebug header (3-pin)
SWCLKSWD ClockDebug header
RASPBERRY PI 4/5 GPIO
40-pin header. 3.3V I/O — NOT 5V tolerant on GPIO. Physical pin numbers vs BCM GPIO numbers differ.
Power Pins
Pin 13.3V3.3V out (max ~50mA)
Pin 25V5V out (from PSU)
Pin 45V5V out
Pin 6,9,14,20,25,30,34,39GNDGround
UART (Pi 4/5)
Pin 8 (GPIO14)UART TXEnable in raspi-config
Pin 10 (GPIO15)UART RX
Pi 4: PL011 on GPIO14/15 after disabling BT overlay
SPI (Pi 4/5)
Pin 23 (GPIO11)SPI0 CLKSCLK
Pin 19 (GPIO10)SPI0 MOSI
Pin 21 (GPIO9)SPI0 MISO
Pin 24 (GPIO8)SPI0 CE0Chip Select 0
Pin 26 (GPIO7)SPI0 CE1Chip Select 1
I2C (Pi 4/5)
Pin 3 (GPIO2)I2C1 SDAHas 1.8kΩ pull-up on board
Pin 5 (GPIO3)I2C1 SCLHas 1.8kΩ pull-up
Enable: raspi-config → Interface Options → I2C
SPI
◆ SPI flash (25QXX series) is common in routers, cameras. Use CH341A programmer + flashrom to read/write. Clip onto SOIC-8 in-circuit with device powered off. Check datasheet for exact pin 1 (marked with dot).
SOIC-8 SPI NOR Flash (W25Q, MX25L, etc)
Pin 1/CSChip Select (active low) → CS/CE on programmer
Pin 2DO/MISOData Out → MISO on programmer
Pin 3/WPWrite Protect — tie HIGH (3.3V) to enable write
Pin 4GNDGround
Pin 5DI/MOSIData In → MOSI on programmer
Pin 6CLKClock → SCLK on programmer
Pin 7/HOLDPause — tie HIGH (3.3V)
Pin 8VCC3.3V power (use programmer VCC)
CH341A Programmer Pinout
Pin 1CSChip Select
Pin 2MISOData from flash
Pin 3WPWrite Protect
Pin 4GNDGround
Pin 5MOSIData to flash
Pin 6CLKClock
Pin 7HOLDHold
Pin 8VCC3.3V
flashrom -p ch341a_spi -r dump.bin
I2C
◆ Use i2cdetect -y 1 on Linux to scan for devices. Common addresses: 0x50-0x57 EEPROM, 0x68 RTC (DS3231), 0x3C/0x3D OLED display, 0x76/0x77 BME280 sensor.
Common I2C Addresses
0x50–57AT24Cxx EEPROM — may contain config/credentials
0x68/69MPU-6050 IMU / DS1307 RTC
0x3C/3DSSD1306 OLED display
0x20–27PCF8574 I/O expander
0x48–4FADS1115 ADC / TMP102 temp sensor
USB
USB Type-A / Type-B
Pin 1VBUS+5V (500mA USB2, 900mA USB3)
Pin 2D−Data negative
Pin 3D+Data positive
Pin 4GNDGround/Shield
USB Micro-B
Pin 1VBUS+5V
Pin 2D−Data−
Pin 3D+Data+
Pin 4IDOTG ID — GND = host mode, float = device
Pin 5GNDGround
USB Type-C (simplified)
A1/B1GNDGround
A4/B4VBUS+5V (or up to 20V with PD)
A6D+USB 2.0 data+
A7D−USB 2.0 data−
A5/B5CC1/CC2Config channel — orientation, PD negotiation
A2/B11TX/RXUSB 3.1 SuperSpeed pairs
IDENTIFY UNKNOWN PORTS
Systematic approach to identifying undocumented debug headers on PCBs.
◆ Tools needed: multimeter, logic analyser (Saleae/cheapo), USB-serial adapter (CP2102/CH340), JTAGulator (optional).
Step 1 — Power Analysis (Multimeter)
Step 1Check voltageDC voltage each pin to GND. Identify: 0V=GND, 3.3V, 5V, 1.8V
Step 2ContinuityRing out to known ground/VCC. Identify power pins.
Step 3Idle stateUART TX idles HIGH. UART RX floats or HIGH. JTAG TDO often floats.
Step 2 — UART Hunt
BootWatch with scopeDuring power-on, TX pin will toggle rapidly — this is serial output
BaudAuto-detectminicom / baudrate.py — try 115200, 57600, 38400, 9600
ConfirmReadable textBootloader strings confirm correct baud + TX pin
RXProbe othersRemaining pin near TX = RX. Sending char should echo.
Step 3 — JTAG Hunt
JTAGulatorAutomatedConnect all suspected pins, run BYPASS scan
ManualOpenOCD scanopenocd -f interface/jlink.cfg -c "jtag scan" (enumerate chain)
TCK hintClock pinTCK often has pull-down or capacitor to ground on PCB
TDO hintOutputTDO may float — high-Z when JTAG not active
Step 4 — Flash Extraction
LocateSOIC-8 chipLook for 8-pin IC near CPU — check markings (W25Q, MX25L, GD25Q)
In-circuitClip onPower device OFF. Use SOIC-8 clip → CH341A
Readflashromflashrom -p ch341a_spi -r firmware.bin
Analysebinwalkbinwalk -e firmware.bin — extract filesystem