←back to thread

The hidden JTAG in a Qualcomm/Snapdragon device’s USB port

(www.linaro.org)
242 points denysvitali | 1 comments | 30 Jun 25 18:34 UTC | HN request time: 0.212s | source
Show context
tripdout ◴[30 Jun 25 19:43 UTC] No.44427076[source]▶
It will be really interesting to see what production devices this is enabled on - It mentions the OnePlus 6 at least which has it fused out but is still accessible.

Edit: How are they reading the eFuses on a production OnePlus 6? Do they have a Qualcomm-signed EL3 EDL loader?

It seems to exist as qcom,msm-eud in the device tree of a (unfortunately production) SM4350 device I have along with an eud_enable_reg. Time to recompile the kernel with `/dev/mem`.

replies(4): >>44427931 #>>44428623 #>>44450259 #>>44455350 #
zorgmonkey ◴[30 Jun 25 21:11 UTC] No.44427931[source]▶
yeah EDL loaders for a bunch of production devices exist here [0] also more on various XDA Forum posts for stuff like unbricking guides. It is worth noting for people who don't

[0]: https://github.com/bkerler/Loaders

replies(2): >>44428173 #>>44432422 #
1. tripdout ◴[30 Jun 25 21:38 UTC] No.44428173[source]▶
But reading QFUSES specifically requires an EL3 loader "edl qfp qfp.bin -> To dump qfprom fuses (only on EL3 loaders)" and I don't believe most devices programmers (especially as relatively new as the OnePlus 6) run under that privilege level.