Part 1: Discovering JTAG on the Adafruit Black Pill — A Practical Guide for Beginners

---

Author: Shafeeque Olassery Kunnikkal | Category: Hardware Hacking, IoT, STM32F411 | Leave a Comment

Introduction

This hands-on guide is designed for learners who want to understand how to find JTAG debug pins on a microcontroller board like the Adafruit Black Pill (STM32F411CE). No prior knowledge of JTAG or embedded debugging is assumed — you’ll learn using a multimeter, Arduino, and free tools.

The Adafruit Black Pill (STM32F411CE) is a powerful compact microcontroller board.

If you want to connect a hardware debugger or identify the JTAG interface for learning or reverse engineering, you’ll need to discover these pins if there is no documentation exist and this guide shows you exactly how to do that.

This first part walks you through using a digital multimeter to identify likely candidates for JTAG pins before using any advanced tools. No programming or firmware flashing is needed yet.

What is JTAG? JTAG (Joint Test Action Group) is a standard for verifying designs and testing printed circuit boards after manufacture. It provides a standardized communication interface for debugging embedded systems, programming flash memory, and performing boundary scans. The typical JTAG pins are:

• TCK (Test Clock): The clock signal that synchronizes the JTAG operations.
• TMS (Test Mode Select): Used to control the state machine within the JTAG Test Access Port (TAP).
• TDI (Test Data In): Serial data input to the TAP.
• TDO (Test Data Out): Serial data output from the TAP.
• TRST (Test Reset – optional): An optional asynchronous reset for the TAP controller.

SWD vs. JTAG: Serial Wire Debug (SWD) is a 2-pin debug interface (SWDIO and SWCLK) that is commonly found on ARM Cortex-M microcontrollers like the STM32. It’s a simpler, faster alternative to JTAG, often sharing pins with JTAG. Many modern firmware’s disable full JTAG to save pins, enabling only SWD, or even disabling both to use the pins as normal GPIOs.

Step 1: Use a Multimeter to Identify JTAG Candidates

The Black Pill is a tiny board with a powerful STM32 chip and JTAG may not even be enabled. Your first job is to identify physical pin candidates — without using firmware or code. You’ll begin with basic continuity and diode tests to identify potential JTAG pins based on how they behave electrically.

What You’ll Need:

• A digital multimeter
• A Black Pill (STM32F411CE) board
• A USB cable (for optional powered tests)

Test 1: Continuity Mode (Beep Test)

1. Power OFF your board — unplug USB.
2. Set your multimeter to continuity mode (usually shown with a sound icon).
3. Connect the black probe to GND (use a known ground pin).
4. Use the red probe to touch each pin on the headers (PAx, PBx, PCx…).
5. Listen for a beep — this indicates a direct path to GND or an internal protection diode.

What to look for:
Pins that beep may be connected to internal debug logic or protected with diodes — a common pattern for TDI, TDO, or nTRST.

Note for Observation:
On many STM32 boards, PA15 and PB3 will give a beep — they are often default JTAG pins (JTDI and JTDO).

Test 2: Diode Mode (Voltage Drop Test)

1. Plug in USB to power the board.
2. Set your multimeter to diode mode (looks like a diode symbol).
3. Keep the black probe on GND.
4. Probe the same header pins with the red probe, one at a time.

What to look for:
A voltage drop between 0.3V and 2V usually indicates a pull-up resistor or protection diode — common on JTAG inputs like TMS and TDI.

Tip:
If you see a reading like 1.9V on PA15, that’s a good candidate for a debug input (like TDI). Pins that read OL (open) are likely floating or unused.

Step 2: Should You Connect USB While Testing?

This is an important question.

Option A: Testing with USB DISCONNECTED

• Prevents firmware from changing pin behavior
• Ideal for pure electrical testing
• Lower risk of false negatives

Option B: Testing with USB CONNECTED

• Powers the board, which may activate internal pull-ups
• Diode mode gives more accurate results
• BUT: if the firmware reconfigures pins (e.g. to GPIO), you might miss JTAG pins

Best Practice:
Start testing with USB disconnected. Then try again with USB powered to compare behavior — especially for diode readings.

Step 3: Why JTAG May Not Be Enabled by Default

Before using any scanning tools, it’s important to know: STM32 chips can disable JTAG entirely.

Here’s why JTAG might not work even if your wiring is perfect:

• JTAG and SWD are controlled by option bytes in STM32 chips.
• Many firmwares disable JTAG and enable only SWD to save pins.
• Some firmwares disable both JTAG and SWD, using the pins as normal GPIOs.

If no firmware is flashed that enables JTAG:
Tools like JTAGenum will see no response, even if you connect to the correct pins.

How to Enable JTAG:
You can either:

• Enter DFU mode (System Boot Mode) to bypass the firmware.
• Flash your own firmware that enables JTAG functions.

In this guide, you’ll first try DFU mode, which is safest and requires no custom code.

Step 4: Entering DFU Mode (System Bootloader)

DFU mode loads a built-in bootloader that leaves debug pins untouched — perfect for JTAG discovery.

How to enter DFU mode on the Black Pill:

1. Hold the BOOT0 button (or set BOOT0 pin high via jumper).
2. Press and release the RESET button.
3. Release BOOT0.
   The chip will now run its internal bootloader and won’t interfere with JTAG pins.

In Windows Device Manager, you should now see:
STM32 BOOTLOADER under USB devices.

Practical Considerations & Next Steps

Common JTAG Pin Locations: JTAG pins are typically grouped together on the microcontroller package, often near the core or power pins. On STM32 microcontrollers, SWD pins (SWDIO and SWCLK) are often multiplexed with JTAG pins, making them good candidates for initial investigation.

Identifying TCK (Clock): The TCK pin is the clock signal. When the board is powered and the microcontroller is running, you might observe a stable voltage or even some activity on this pin using a multimeter in voltage mode. A logic analyzer would show a clear clock signal.

Using a Logic Analyzer/Oscilloscope: For more advanced identification, a logic analyzer can capture the digital signals on suspected JTAG pins and decode them, confirming if they are indeed JTAG signals. An oscilloscope can help visualize the waveforms and identify clock signals.

Connecting a Debugger: Once potential JTAG/SWD pins are identified, the next step is to connect a JTAG/SWD debugger (e.g., ST-Link V2/V3, J-Link, Segger). These debuggers connect to your computer via USB and to the target board via the identified debug pins.

Software Verification: Use software tools like OpenOCD (Open On-Chip Debugger), STM32CubeProgrammer, or an integrated development environment (IDE) like STM32CubeIDE or VS Code with appropriate extensions. These tools can attempt to connect to the microcontroller via the debugger and verify if the JTAG/SWD interface is functional. A successful connection confirms the correct pin identification.

Software Debugging Basics: Once connected, JTAG/SWD allows you to:

• Set Breakpoints: Pause program execution at specific lines of code.
• Step Through Code: Execute code line by line.
• Inspect Variables and Memory: View the values of variables, registers, and memory contents in real-time.
• Flash Programming: Upload new firmware to the microcontroller’s flash memory.

Troubleshooting

Incorrect Wiring: Double-check all connections between the multimeter/debugger and the Black Pill. Refer to the pinout diagram carefully.

JTAG/SWD Disabled in Firmware: If the firmware running on the Black Pill has disabled the debug interface, you might not be able to connect. Entering DFU mode (as described in the article) is crucial here, as it uses a built-in bootloader that doesn’t interfere with debug pins.

Driver Issues: Ensure that the necessary drivers for your JTAG/SWD debugger are correctly installed on your computer.

Power Issues: Verify that the Black Pill is properly powered during testing.

Incorrect Debugger Settings: If using a debugger, ensure the software (e.g., OpenOCD, STM32CubeProgrammer) is configured for the correct target microcontroller (STM32F411CE) and debug interface (JTAG or SWD).

Recap Before Moving On

At this point, you should:

• Have identified several pins (like PA15, PB3, PB4, PB13, PB14, PB15) that look like JTAG candidates.
• Know why JTAG might be invisible until enabled.
• Have entered DFU mode to ensure a clean testing environment.

Next Up: Part 2
You’ll prepare an Arduino board (like the Due or Nano) to run JTAGenum, connect it to your STM32, and scan the pins automatically.

Related Posts