Blackjack

Overview

Blackjack plugs into an iPhone or iPad and gives a Mac direct access to the processor inside. Over one USB-C cable it can halt and step the chip, read and write its memory, follow its serial console, and move the device between normal, recovery and DFU, the low-level access an engineer uses to bring a board up.

To the host it looks like a standard debug probe, so existing debugging tools and scripts carry over unchanged. Apple builds this class of tool for itself, under the names Kanzi and Koba, and never sells it. Blackjack does the same job from a board anyone can make, for a few dollars of parts.

At a glance

Function

SWD, JTAG, UART and serial-console debug probe

Targets

iPhone and iPad, over Lightning or USB-C

Host

USB-C to a Mac; appears as a standard debug probe

Controller

RP2350 — dual Arm Cortex-M33, 150 MHz

Memory

16 MB flash, 8 MB PSRAM

Board

55.05 × 24.05 mm, 8 layers, 0.8 mm, ENIG, black mask

Firmware

Deoxy fork of Tamarin (open source, by stacksmashing)

Part number

810-26830-01

Status

Design complete; fabrication packages built, not yet ordered

The board

Where the early probes were a microcontroller and a connector, the current board is a single dense design: 55.05 by 24.05 millimetres, 0.8 millimetres thick, eight copper layers, black mask over gold-plated pads. An RP2350 does the work; around it sit a USB hub, the flash that holds the firmware, a switching-and-measuring power supply, the connectors and a field of labelled test pads. The part number is written into the copper.

Connectors

Everything lands on one edge, so the board sits flush in its case with a single face of ports.

Signal integrity

A compact eight-layer board is mostly a routing problem. The gen-two layout began with 302 connections with nowhere to go; closing every one, by hand and with a custom router, took it to zero unrouted.

Connectivity is the easy half. The USB data lines are differential pairs: two tracks that must run together, matched in length and spacing, over an unbroken reference plane. On a board this tight that is a fight. The receptacle ties the halves of each pair across its own pins, and almost two metres of signal copper ends up crossing the planes it is meant to reference. A custom tool re-routes a pair as a coupled bundle; the remaining issues are a handful of review-rule warnings with no manufacturing violations. The RP2350's second USB is driven in software through Pico-PIO-USB, so the board can act as a host and pass the target through to the Mac.

Fabrication

Fitting eight layers and 157 footprints into a gum-stick board needs 0.08 millimetre tracks and vias drilled by laser at 0.075 millimetres: HDI, the same class of board that goes inside a phone. Not every fab can make it; JLCPCB's HDI process can. Two fabrication packages are built and waiting, one for bare boards and one for assembled, each with gerbers, the layer stack-up, drill files per via span, assembly data and a bill of materials. Nothing has been ordered.

Firmware

The firmware is a Deoxy fork of stacksmashing's Tamarin, the open-source project the whole effort is built on, carried from the RP2040 of the early cables to the RP2350 of the board and rebuilt for each revision. To the host it presents as a standard debug probe; how it brings a device up to that point stays in-house.

Lineage

Five years, from a hand-wired cable to the current board.

The 2022 Pascal built on the D71 Breakout, a six-inch board carrying the first RP2040 probe. We still have its Gerber files, so here it is as a 3D model.

Status

The early cables work. The gen-two board is a finished eight-layer design with its fabrication packages built, waiting on a first production run.

Blackjack is independent research and a hobby hardware project, built for working on devices we own. It is not affiliated with or endorsed by Apple. It builds on the open-source Tamarin firmware by stacksmashing. Apple, iPhone, iPad and Lightning are trademarks of Apple Inc. Raspberry Pi and RP2350 are trademarks of Raspberry Pi Ltd.