Every JTAG-equipped chip has a Test Access Port (TAP) — a 16-state finite-state machine δ(state, TMS) → state′, clocked by TCK and steered by one serial control line, TMS. The four wires (TCK, TMS, TDI, TDO) are standardised in IEEE 1149.1 and present on almost every microcontroller, FPGA and SoC, usually broken out to unpopulated header pins on the PCB.
Run-Test/Idle --TMS=1--> Select-DR --TMS=0--> Capture-DR
Capture-DR --TMS=0--> Shift-DR (loops on TMS=0, shifting 1 bit/TCK)
Shift-DR --TMS=1--> Exit1-DR --TMS=1--> Update-DR --TMS=0--> Run-Test/Idle
Inside Shift-DR, the boundary-scan register is an N-bit shift chain wrapped around every I/O pin:
for each TCK rising edge:
TDO = chain[N-1]
chain[i] = chain[i-1] for i = N-1 … 1
chain[0] = TDI
On Update-DR the latched chain is applied to the pins according to the loaded instruction:
- SAMPLE/PRELOAD — Capture-DR loads the chain with the pins' current values, non-intrusively; an attacker with SAMPLE access can read live signals without stopping the chip, ideal for reverse-engineering a bus protocol.
- EXTEST — Capture-DR ignores the pins; whatever bit pattern you shift in is driven straight onto the output pins at Update-DR, overriding the chip's own logic entirely. This is how a JTAG debug port becomes a full hardware bypass: force a "secure boot OK" GPIO high, glitch a reset line, or walk an external flash chip's address/data bus one bit at a time to dump firmware — no valid credentials required, only physical or bed-of-nails access to the exposed pins.
This is exactly why production hardware disables or fuses off JTAG (or gates it behind a challenge-response debug-authentication scheme) before shipping — an open TAP port defeats software-only protections such as secure boot, since it operates below the CPU and can rewrite or observe anything the pins touch.