JTAG Boundary-Scan Chain: TAP Controller Attack Surface

Almost every embedded chip — microcontroller, FPGA, SoC — exposes a four-wire IEEE 1149.1 debug port whose 16-state Test Access Port machine can shift bits through a boundary-scan register wrapped around every pin. This simulator lets you drive that state machine by hand with real TMS pulses, watch a boundary-scan register of 4–16 cells shift a live bit pattern in 3D around a chip die, and switch into EXTEST mode to see exactly how a hardware attacker uses the debug port to force output pins to arbitrary values — bypassing secure boot and every other software protection running on the CPU, because JTAG sits below it.