So I have some d13bold voting machines. Accuvote TSX to be precise.
I haven't had much luck getting into them so far but tonight was neat.
They have a CPU Jtag and a CPLD jtag header on them which is promising. I've previously struck out on the usb header and debug mode. Also a file system vulnerability on a previous model had been fixed. (I think) Turns out they have an intel PXA255 processor chip.
Hooked up the olimex jtag unit and after some reading/configuring and a few false turns got the jtag debugger to connect.
The command I used to get here is: ./openocd -f ./interface/ftdi/olimex-arm-usb-ocd-h.cfg -f board/pxa255_sst.cfg
This is fun but I'm at a loss currently. I'm going to do some youtube/reading up on this on how to dump the memory.
Right now I'm out of time for the night, got a day job and all but wanted to share the news.
Oh, if you want a shiny decommissioned d13bold accuvote TSX touch screen voting machine of your own to play with I'm selling them to the security community for $75 a pop. I've got 17 extra currently.
~John Aho