{"id":13826563,"url":"https://github.com/denandz/lpc_sniffer_tpm","last_synced_at":"2026-01-16T16:45:40.449Z","repository":{"id":91144488,"uuid":"175122930","full_name":"denandz/lpc_sniffer_tpm","owner":"denandz","description":"A low pin count sniffer for ICEStick - targeting TPM chips","archived":false,"fork":false,"pushed_at":"2020-06-08T23:28:53.000Z","size":30,"stargazers_count":165,"open_issues_count":1,"forks_count":28,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-07-09T00:42:40.516Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Verilog","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/denandz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-03-12T02:50:12.000Z","updated_at":"2025-06-22T14:10:09.000Z","dependencies_parsed_at":"2023-07-24T00:00:47.250Z","dependency_job_id":null,"html_url":"https://github.com/denandz/lpc_sniffer_tpm","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/denandz/lpc_sniffer_tpm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denandz%2Flpc_sniffer_tpm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denandz%2Flpc_sniffer_tpm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denandz%2Flpc_sniffer_tpm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denandz%2Flpc_sniffer_tpm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/denandz","download_url":"https://codeload.github.com/denandz/lpc_sniffer_tpm/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denandz%2Flpc_sniffer_tpm/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28480080,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T11:59:17.896Z","status":"ssl_error","status_checked_at":"2026-01-16T11:55:55.838Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T09:01:40.358Z","updated_at":"2026-01-16T16:45:40.431Z","avatar_url":"https://github.com/denandz.png","language":"Verilog","funding_links":[],"categories":["\u003ca id=\"7bf0f5839fb2827fdc1b93ae6ac7f53d\"\u003e\u003c/a\u003e工具","Verilog"],"sub_categories":["\u003ca id=\"32739127f0c38d61b14448c66a797098\"\u003e\u003c/a\u003e嗅探\u0026\u0026Sniff"],"readme":"# TPM Specific lpc sniffer (low pin count) for ice40 stick\n\nTurn the ice40 stick into a LPC sniffer, only logging TPM specific messages. This repository is a duplicate of [https://github.com/lynxis/lpc_sniffer/](https://github.com/lynxis/lpc_sniffer/), with modifications made to only log messages with start field `0101` and address between `24` and `27`.\n\nThis project was used to extract BitLocker VMK keys by sniffing the LPC bus when BitLocker was enabled in it's default configuration. More information is available [in this post](https://pulsesecurity.co.nz/articles/TPM-sniffing).\n\n# features\n\n- i/o read + writes\n- memory read + writes\n- sync errors\n\n# How to use\n\n1. modify EEPROM of the FTDI and enable OPTO mode on Channel B\n1. program lpc_sniffer.bin into your ice40 by `iceprog lpc_sniffer.bin`\n1. note: previous command can be replace by `make install`\n1. connect the LPC bus\n1. extract LPC data: python3 `./parse/read_serial.py /dev/ttyUSB1` | tee outlog\n1. extract key from data: cut -f 2 -d\\' outlog | grep '2...00$' | perl -pe 's/.{8}(..)..\\n/$1/' | grep -Po \"2c0000000100000003200000(..){32}\"\n\n# what connectors are used on the IceStick?\n\n- J1 connector\n```\n\tVCC 3.3|NC 1\n\tGND        2\n\tlpc_clock  3\n\tlpc_ad[0]  4\n\tlpc_ad[1]  5\n\tlpc_ad[2]  6\n\tlpc_ad[3]  7\n\tlpc_frame  8\n\tlpc_reset  9\n```\n- uart output over the ftdi\n\n## LEDs\n\n```\n\tFor orientation: the usb port points south:\n\tgreen in the middle: overflow_led\n```\n\noverflow\\_led when internal buffer is full. No more LPC frames are decoded\n\n# Uart protocol\n\nThe LPC sniffer will write out frames onto the **second** uart of FTDI with 921600 baud.\n\n## format\n\n- 4 byte: address\n- 1 byte: data\n- 1 byte: 0-3bits: direction+type, 4-7: errorcode\n- 2 byte: '\\r\\n'\n\n## error codes\n\nAn error code is decoded in 4 bits\n- 0001 - sync timeout.\n\n# Internal documentation\n\nA LPC frame will:\n\n1. decoded by the LPC decoder\n2. saved into the internal memory\n3. padded by \\r\\n\n4. written onto uart\n\n## in memory layout\n\nThe internal memory is used as 48bit addressable memory.\n48 bit is exact one lpc frame\n\n- 4 byte: address\n- 1 byte: data\n- 1 byte: direction/type + error code\n\n## internal buffer\n\nThe LPC sniffer is using an internal buffer. When the internal buffer\nis full, new frames will be discarded. The green LED in the middle will turn on.\nThe internal buffer can save up to 2\\*\\*10 lpc frames (1024).\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenandz%2Flpc_sniffer_tpm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdenandz%2Flpc_sniffer_tpm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenandz%2Flpc_sniffer_tpm/lists"}