From the looks of the insides, it is highly likely that the debugger features are implemented in a FPGA. This gives us two possibilities: 1) it might be possible to reprogram the FPGA to enable JTAG debugging (my theory is that nintendo uses similar hw internally but different FPGA hardware definitions for developers. cuts down costs). 2) since the FPGA is connected directly to the main SoC, it could provide a very convenient way to try to trigger the timing attack without having to create custom hw.I'm going to assume @yifan_lu's method is involving either decapping the chip, or performing the exception-vector timing attack from hardware as outlined earlier in the thread?
I can't justify spending the money just to test this hypothesis since I could be wrong and brick a dev unit in the process.
Last edited by yifan_lu,