When debugging or accessing hardware firmware, JTAG and SWD can be really helpful to the developer, engineer or reverse engineer.

When looking at an unknown board/device tools such as JTAGEnum or JTAGulator are really helpful in identifying JTAG pinouts or pads.

What techniques exist for enumerating or identifying SWD pinouts?


The same technique of opportunistically scanning pins on a device can be applied, however the scanning sequence will be significantly slower - an SWD target is silent until it receives a valid reset/READ_ID sequence (and potentially the JTAG/SWD switching sequence for a multi-mode target). This sequence is ~80 bits.

In addition, there is nothing directly comparable to the JTAG scan chain or instruction register which you might want to discover - just the AP address space (255 slaves), and the 2/4GB debug memory space provided by each MEM-AP attached to the DAP. There will be a ROM table to declare debug components, but nothing forces a device to fully use this.

You can probably gain most from knowing that both of the SWD pins are (by default) inputs, with a pull-up on SWDIO (or as suggested in the comments, tracing the tracks to potential header/probe footprints).

  • 2
    \$\begingroup\$ There's also the possibility of the SWD pins being disabled/repurposed in operation, making tracing the connections often the best bet. Even toys often have obvious SWD header footprints, not infrequently actually labelled. Fortunately the majority of SWD devices one is likely to encounter are TQFP or QFN; BGA and various CSP happen, but less often. \$\endgroup\$ – Chris Stratton Feb 19 '18 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.