In our last IoT blog post we dove headfirst into IoT Security Assessments with a crash course in the methodology used on a day-to-day basis. There were a handful of tools mentioned that play a crucial role in performing these assessments, and I’m sure you’re eager to learn not just what these tools are but also how they can be effectively used in hardware analysis.

In this post, we are going to outline the essential tools of the trade, focusing on those that are absolute necessities, easily accessible, and budget-friendly. This series is suitable for all skill levels but is particularly aimed at those who are curious about the craft and want to start learning. While it may seem daunting at first, with the right direction, you will begin to understand how the methodology and physical tools work together to create a seamless process that can be applied to any device.

Without further ado, let’s dive in and examine the tools that will enhance your hardware hacking expertise and enable you to navigate this dynamic field with confidence and precision.

Tooling Considerations

There are many options for tooling, and many have components of the functionality we seek, so even the task of choosing what to purchase and use can seem overwhelming. Before we get into the tools themselves, let’s quickly discuss some criteria for selecting tools.

Necessity
The first and foremost consideration is necessity. Especially when just starting out, the ability to experiment and buy a bunch of random debug boards may not be very feasible. The tools we choose should provide the essential functionalities that cover many or all aspects of a particular assessment task. For example, rather than purchasing a debug board specific to interfacing with a single serial protocol (UART, JTAG, SPI, etc.), we should look for one that can perform many, if not all, of this analysis. Thankfully, these days, there are a few options out there that are multifaceted and can do exactly that.

Accessibility
Next, accessibility is a major consideration. We should aim to choose tools that are readily available and easy to use, regardless of technical background or experience level. This means selecting tools with user-friendly interfaces, comprehensive documentation, and robust community support.

Cost-Effectiveness
Finally, the need for cost-effectiveness will always be a huge reality. While there are numerous high-end tools available, we’ll focus on those that deliver exceptional value without breaking the bank. For this and all the points above we are fortunate to have multiple solutions out there that do not sacrifice capability for financial investment.

The Essentials

Before we get into more advanced tooling like debug boards, logic analyzers, or interface adapters, let’s talk about some actual physical tools and accessories that no hardware hacking bench would be complete without. There are many options at many price points, and I’d recommend further research to determine what is best for you and your circumstances.

Multimeters

A multimeter is an invaluable tool for anyone working with electronics or electrical systems. It can measure several aspects of electricity, such as voltage, current, resistance, and sometimes other quantities like capacitance and temperature. In general, the multimeter will be the first tool we use to identify ground and voltage levels. There are many brands and price points, and in general, the more expensive, the more accurate. Now, whether that level of accuracy is necessary when you’re getting started is arguable. A very popular brand that is often recommended is Fluke. They make multimeters at both ends of the expensive and inexpensive range. The two pictured below are “cheaper” but perform well enough to use while learning and practicing.

---

Soldering Iron

A soldering iron is a hand tool with a heated metal tip used to melt solder, a fusible metal alloy that creates a permanent bond between metal workpieces. In hardware hacking, proficiency with a soldering iron is considered a fundamental skill. It is vital for attaching and detaching components on printed circuit boards (PCBs) and generally interacting with devices in unique ways that would be otherwise impossible. They also allow for precise control when modifying, repairing, interacting with, or creating custom hardware configurations.

There are also some further considerations and required accessories. The choice of solder is important, with lead-free versions becoming more common due to environmental concerns. Whether people admit it or not, most prefer leaded solder for its lower melting point and easier workability. Then, there is also flux, either integrated into the solder or applied separately, which helps improve solder flow and connection quality. One quality-of-life accessory that can make the process easier is a heat-resistant soldering mat, which protects work surfaces and can include helpful features like component holders.

Safety is paramount. Proper ventilation or a fume extractor is essential to remove potentially harmful solder fumes, while safety glasses protect against burns and splashes. There are many stories of soldering making its way not only onto hands (we’ve all burned ourselves) but, more importantly, into people’s eyes. These days there are many resources for learning, but YouTube has great tutorials.

---

Screwdrivers & Pliers

Screwdrivers, bits (specifically security bits), and pliers are essential tools in our toolkit, often serving as the first line of attack when attempting to access a device’s internals. Personally, I prefer to use the kits that are often branded for use with electronics/mobile device repair. These are purpose-built for things like what we may be assessing and allow for easily changing bits and working with small components.

Let’s quickly talk about security bits. Standard screwdrivers are helpful for common fasteners, but security bits are essential when dealing with specialized screws designed to deter unauthorized access. These include Torx security, tri-wing, pentalobe, and other proprietary screw types frequently used in consumer electronics, game consoles, and security-focused devices. A good set of security bits allows us to bypass these physical security measures and gain access to internal components.

Pliers come in various types, each serving specific purposes (mainly as a tool to pry things open), such as needle-nose pliers, which are amazing for manipulating small components and wires in tight spaces. Wire cutters and strippers are essential for modifying connections and building custom cords, which can happen more than you may think. Tweezers—while not strictly pliers—are crucial for handling tiny surface-mount components.

---

Jumper Wires

Jumper wires, often referred to as Dupont wires, serve as flexible, temporary connectors between electronic components. These short electrical wires, available in male-to-male, female-to-female, and male-to-female configurations, enable rapid prototyping and testing without the need for soldering. In hardware hacking, jumper wires find numerous applications, from creating UART connections for accessing debug consoles to tapping into SPI or I2C buses for data sniffing. They’re also crucial for bypassing security features by shorting specific pins or setting up power glitching experiments. The versatility of jumper wires allows us to quickly reconfigure connections, test hypotheses, and modify circuits both permanently and non-permanently. However, it’s important to use quality jumper wires to ensure reliable connections—and proper organization is key when dealing with complex setups. Different lengths and colors can aid in keeping projects tidy and easier to debug. Whether used in conjunction with breadboards, logic analyzers, or directly on PCBs, jumper wires remain a fundamental tool during exploratory work or creating custom testing environments.

---

Test Clips

Before we talk about test clips, there are some caveats that are important to remember. Sometimes, you may think that things aren’t working properly when using these clips in circuit. This is because it can be difficult to ensure that they are properly attached to the chip legs, and sometimes, it’s just not really possible to effectively interface with a chip without completely desoldering it. While this is outside the scope of this post, it’s worth researching these things.

With all that said, SOIC clips, test clips, or IC test clips are designed specifically for interfacing with SOIC (Small Outline Integrated Circuit) packages without the need for soldering. These spring-loaded clips attach securely to SOIC chips while in-circuit, providing easy access to all pins simultaneously. They’re particularly useful when working with flash memory chips, microcontrollers, and other critical components that are often found in SOIC packages on modern electronic devices. The clips come in various sizes to accommodate different SOIC variants, typically featuring a ribbon cable or header pins for easy connection to logic analyzers, programmers, or custom debugging setups. The ease of use for non-destructive testing, debugging, and even firmware extraction or modification on live systems is very appealing in many scenarios that require care not to destroy components.

---

Advanced Tooling

Debug Boards

Debug boards are versatile platforms designed to interface with various electronic systems, providing a bridge between the target hardware and our analysis setup. These boards often support multiple protocols and voltage levels, making them adaptable to a wide range of devices. We are just going to touch on a few of my favorites here, again, with cost and usability in mind.
Bus Pirate(new version 5 is out!) is a popular open-source multi-tool that serves as a universal bus interface. It supports numerous protocols, including I2C, SPI, UART, and 1-Wire, among others. The Bus Pirate can act as a controller or peripheral device, making it amazing for probing, debugging, and programming various chips and modules. Its built-in voltage measurement capabilities and the ability to supply power to target devices further enhance its utility in hardware hacking scenarios. This doesn’t even begin to describe the full feature set of this device, but their forums, documentation, and support are robust. Oh, and now it’s super colorful, so that’s fun.

Tigard is a powerful FT2232-H based debug board, well known for its robustness and versatility. The Tigard supports a wide range of low-level protocols and is feature-rich with things like configurable voltage levels, native support for common tools (OpenOCD, FlashROM, etc.), and easy switching between desired modes (SPI/JTAG & I2C/SWD), making it suitable for interfacing with diverse embedded systems. Like the Bus Pirate, the Tigard checks all the boxes for necessity, usability, and affordability.

Segger debug probes, while primarily known for their use in embedded software development, are also valuable in assessing devices. Tools like the J-Link series provide high-speed debugging and programming capabilities for a vast array of microcontrollers. Their ability to handle multiple debug protocols and robust software support makes them a powerful asset. Honestly, I was a bit hesitant to include this last one. One, because there are certainly other options, and two, because in general, unless you are buying the J-Link EDU Mini (pictured below), these are definitely not cost-effective for those just getting into things. The reality is, however, that these are great tools to familiarize yourself with and can be amazing in enterprise assessment scenarios.

---

Logic Analyzers

Logic analyzers are powerful diagnostic tools that capture and display multiple digital signals simultaneously, allowing users to observe and analyze complex digital systems in real time. Modern logic analyzers, often USB-based for portability, offer high sample rates and deep memory buffers, enabling the capture of fast signals over extended periods. They excel at decoding various communication protocols such as I2C, SPI, UART, and CAN. Advanced features like trigger conditions and protocol-aware capturing allow us to isolate specific events or data patterns for things like determining protocol type or extracting sensitive information. The visual representation of signal timing and the ability to export captured data are other extremely useful features.

There are many logic analyzers out there of varying price points. You’ll likely hear a lot about the Saleae, which, while a wonderful tool, does not align with the cost-effectiveness goal of this post. DreamSourceLab is another brand that is solid and much cheaper, but still not what I’d recommend for starting out.

HiLetGo is a twelve-dollar logic analyzer that checks all the boxes for not only folks starting out but seasoned professionals. It’s worth doing more research to understand what exactly makes these devices vary in price, but it generally comes down to things like sample rate. This device can also be used with the Saleae software, which is a huge plus.

---

Flash Reader/Programmer

Flash memory chips often contain firmware or sensitive data, making them prime targets during security assessments. Dedicated flash reading tools are essential for accessing these chips. It’s worth noting that for various reasons, if you’re trying to interface with the chip directly on the board or in circuit, it is not always possible. Like the rest of these devices, there are many options available in this category. Another that you’ll find but that I am not including here due to price is the XGecu. The Segger could also be included in this section.

CH341A is a popular and affordable USB programmer that supports a wide range of memory chips, including EEPROM, SPI Flash, and I2C devices. Its versatility and low cost have made it a staple in our toolkits. The CH341A can be used to read the contents of flash chips, potentially revealing firmware or stored data, or to write modified firmware back to the chip.

---

RF Analysis

I was initially going to leave out this section in an effort to keep the focus strictly on hardware tooling (and to keep costs low), but at the end of the day, knowledge of the various protocols used by devices for communications is essential. Like all the categories before, there are many tools that can be used for these purposes. There are many different protocols a device can use, such as Wi-Fi, Bluetooth, Zigbee, LoRa, and more. We’ll focus on two of the most common – Wi-Fi and Bluetooth (specifically BLE).

---

Wireless

The Alpha wireless card (AWUS036ACH) is an external USB Wi-Fi adapter that is commonly used and is known for its powerful signal strength, long-range capabilities, and functionality that allows packet injection and monitor mode. Not all adapters have these last two capabilities, which make this tool specifically useful for attempting to intercept and manipulate wireless communications.

---

Bluetooth Low Energy

There are quite a few tools that can be used to intercept and interact with Bluetooth low energy communications. There’s even an application that can be run from an Android phone called NRFconnect, which utilizes the internal Bluetooth functionality of the phone to analyze, sniff, and interact with Bluetooth devices on a fairly low level. One of the biggest reasons I’d recommend the following dongle is due to the ability to interface with Wireshark and observe communications in real-time.

The nRF52840 Dongle is low-cost and supports BLE, Bluetooth 5.4, Bluetooth mesh, Thread, Zigbee, ANT, and other 2.4GHz proprietary protocols. It is primarily used for Bluetooth low energy sniffing and wireless protocol reverse engineering. Its small form factor and the ability to interface with popular analysis software (Wireshark) make it an extremely useful asset.

---

Conclusion

Embarking on a journey into hardware hacking doesn’t have to break the bank. The low-cost tools discussed in this post provide an excellent starting point for beginners (and professionals) to explore the fascinating world of hardware manipulation and analysis. From versatile multimeters and budget-friendly soldering irons to affordable logic analyzers and programmable development boards, these tools offer a solid foundation for learning and experimentation.

As you progress in your learning, remember that creativity and curiosity often trump expensive equipment. Moreover, the open-source community and online resources provide a wealth of information and support. Engage with fellow enthusiasts, share your experiences, and don’t hesitate to ask for advice when needed.